Skip to content
Fencer Intel
medium 6.5

CVE-2016-2311 json

Black Box AlertWerks ServSensor with firmware before SP473, AlertWerks ServSensor Junior with firmware before SP473, AlertWerks ServSensor…

published 2016-05-30 10 y ago modified 2026-06-17 4 mo ago also EUVD-2016-3395

cvss
6.5
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits
0
none known

Summary

Black Box AlertWerks ServSensor with firmware before SP473, AlertWerks ServSensor Junior with firmware before SP473, AlertWerks ServSensor Junior with PoE with firmware before SP473, and AlertWerks ServSensor Contact with firmware before SP473 allow remote authenticated users to discover administrator and user passwords via unspecified vectors.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-16-147-03 updated cvss 6.5

Black Box AlertWerks ServSensor Credential Management Vulnerability

  • Black Box AlertWerks ServSensor Contact, model number EME111A-20-R2 <firmware_SP473 Black Box AlertWerks ServSensor Contact, model number EME111A‑60-R2 <firmware_SP473 Black Box AlertWerks ServSensor Contact, model number EME112A-20-R2 <firmware_SP473 Black Box AlertWerks ServSensor Contact, model number EME112A-60-R2 <firmware_SP473 Black Box AlertWerks ServSensor Contact, model number EME113A-20-R2 <firmware_SP473 Black Box AlertWerks ServSensor Contact, model number EME113A‑60-R2 <firmware_SP473
    +13 more products
    Black Box AlertWerks ServSensor Junior with PoE, model number EME152A <firmware_SP473 Black Box AlertWerks ServSensor Junior with PoE, model number EME153A <firmware_SP473 Black Box AlertWerks ServSensor Junior with PoE, model number EME154A <firmware_SP473 Black Box AlertWerks ServSensor Junior with PoE, model number EME155A <firmware_SP473 Black Box AlertWerks ServSensor Junior with PoE, model number EME158A <firmware_SP473 Black Box’s AlertWerks ServSensor Junior, model number EME103A-R2 <firmware_SP473 Black Box’s AlertWerks ServSensor Junior, model number EME104A-R2 <firmware_SP473 Black Box’s AlertWerks ServSensor Junior, model numbers EME102A-R2 <firmware_SP473 Black Box’s AlertWerks ServSensor, model number EME105A <firmware_SP473 Black Box’s AlertWerks ServSensor, model number EME106A <firmware_SP473 Black Box’s AlertWerks ServSensor, model number EME108A-R2 <firmware_SP473 Black Box’s AlertWerks ServSensor, model number EME109A-R2 <firmware_SP473 Black Box’s AlertWerks ServSensor, model number EME110A-R2 <firmware_SP473
    affected: mitigation “Black Box recommends that users should install the new firmware version.”

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

1.15% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
NVD 3.0 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N

Classification

Weakness
  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
  • CWE-255 Credentials Management Errors

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.