{"id":"CVE-2016-7836","published":"2017-06-09T16:29:01Z","modified":"2026-06-17T00:53:34Z","title":"SKYSEA Client View Improper Authentication Vulnerability","vendor":"SKYSEA","product":"Client View","tier":"core","eol":null,"description":{"text":"SKYSEA Client View Ver.11.221.03 and earlier allows remote code execution via a flaw in processing authentication on the TCP connection with the management console program.","provenance":"source","from":"NVD"},"summary":{"text":"The SKYSEA Client View product, in version 11.221.03 and earlier, contains an improper authentication flaw in how it processes authentication on the TCP connection with the management console program. An attacker with network access to that connection can achieve remote code execution, with no authentication or user interaction required and no special configuration needed.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:10:08Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.1923,"percentile":0.97323,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2025-10-14","dueDate":"2025-11-04","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","notes":"https://www.skyseaclientview.net/news/161221/ ; https://nvd.nist.gov/vuln/detail/CVE-2016-7836","provenance":"source"},"vulncheckKev":{"dateAdded":"2017-10-12","exploitedFirstSeen":"2017-10-12","ransomware":false,"evidence":[{"url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses","date":"2017-10-12"},{"url":"https://threatpost.com/virus-bulletin-japanese-attacks-apt-strategygy/148859/","date":"2019-10-02"},{"url":"https://www.virusbulletin.com/virusbulletin/2020/05/vb2019-paper-apt-cases-exploiting-vulnerabilities-regionspecific-software/#ref3","date":"2020-05-01"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-10-14"},{"url":"https://cyble.com/resources/research-reports/global-cybersecurity-report/","date":"2025-12-11"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"}],"evidenceTotal":6,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-287","name":"Improper Authentication"}],"references":[{"url":"http://www.securityfocus.com/bid/95062","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.skyseaclientview.net/news/161221/","tags":["Vendor Advisory"]},{"url":"https://jvn.jp/en/jp/JVN84995847/index.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.skygroup.jp/security-info/170308.html","tags":["Exploit","Technical Description","Third Party Advisory"]},{"url":"http://www.securityfocus.com/bid/95062","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://www.skyseaclientview.net/news/161221/","tags":["Vendor Advisory"]},{"url":"https://jvn.jp/en/jp/JVN84995847/index.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://www.skygroup.jp/security-info/170308.html","tags":["Exploit","Technical Description","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-7836","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: remote exploit of network-facing management service","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows remote code execution via a flaw in processing authentication on the TCP connection","start":45,"end":135}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: direct remote code execution impact","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows remote code execution via a flaw","start":45,"end":84}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2016-8685","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-8685","exploited":true,"exploitedSince":"2025-10-14","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":["https://www.skygroup.jp/security-info/170308.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2017-06-09","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2016-7836","provenance":"source"},{"date":"2017-10-12","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses","provenance":"source"},{"date":"2025-10-14","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-10-14","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2016-8685","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":3049},"priority":{"score":69.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3304 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.46,"detail":"percentile 0.9732"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}