What is CVE-2016-10157?

CVE-2016-10157 is a critical-severity vulnerability in Akamai Netsession, classified under Code Injection. CVSS score: 9.8/10. Published 2017-01-23.

How severe is CVE-2016-10157?

Critical severity. CVSS v3 base score is 9.8 out of 10.

RCE in Akamai Netsession

CVE-2016-10157

Akamai NetSession 1.9.3.1 is vulnerable to DLL Hijacking: it tries to load CSUNSAPI.dll without supplying the complete path. The issue is aggravated because the mentioned DLL is missing from the installation, thus making it possible to hijack the DLL and subsequently inject code within the Akamai NetSession process space.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.023 (81.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Akamai Netsession — versions 1.9.3.1
N/a — versions n/a

Weakness classification (CWE)

CWE-94 — Code Injection

References

cve@mitre.org (VDB Entry, Third Party Advisory, x_refsource_MISC)
cve@mitre.org (vdb-entry, x_refsource_BID)

Frequently asked questions

What is CVE-2016-10157?: CVE-2016-10157 is a critical-severity vulnerability in Akamai Netsession, classified under Code Injection. CVSS score: 9.8/10. Published 2017-01-23.
How severe is CVE-2016-10157?: Critical severity. CVSS v3 base score is 9.8 out of 10.