CVE-2016-9796

Published: Dec 3, 2016Updated: May 6, 2026 Sources: CVE List NVDCWE-264

9.8CRITICAL

NVD MITRE

Description

Alcatel-Lucent OmniVista 8770 2.0 through 3.0 exposes different ORBs interfaces, which can be queried using the GIOP protocol on TCP port 30024. An attacker can bypass authentication, and OmniVista invokes methods (AddJobSet, AddJob, and ExecuteNow) that can be used to run arbitrary commands on the server, with the privilege of NT AUTHORITY\SYSTEM on the server. NOTE: The discoverer states "The vendor position is to refer to the technical guidelines of the product security deployment to mitigate this issue, which means applying proper firewall rules to prevent unauthorised clients to connect to the OmniVista server."

In plain language

AI Worth attention

OmniVista 8770 Network Management System versions 2.0 through 3.0 can let a network-connected attacker take full control without logging in, so restrict access to port 30024 now.

Executive summary

Unauthenticated network RCE via exposed GIOP/ORB interfaces on TCP port 30024 allows execution of operating-system commands with full administrative privileges.

If affected, business impact

Full server takeoverNetwork management disruptionNetwork configuration changesSensitive data exposureRansomware risk

What to do now

Check whether you run OmniVista 8770 Network Management System and whether TCP port 30024 is reachable from untrusted networks.
There is no confirmed fixed version available; ask your Alcatel-Lucent/Nokia support contact for the supported remediation path.
Block inbound TCP port 30024 at firewalls except from specifically approved management systems.
Review the server for unexpected administrator-level commands, jobs, or configuration changes.

May need vendor / contractor work

What is it

A weakness in this network-management server can allow an outsider who reaches it to skip the normal sign-in process and run commands as its top-level administrator. It is like someone finding an unlocked service entrance to your control room and being able to operate every switch inside.

Who is affected

This matters to you if you run OmniVista 8770 Network Management System. No account or employee action is needed; it is a risk only if an attacker can reach TCP port 30024 and the server responds to these management-interface requests.

How urgent is it

An attacker who can reach the exposed service can take over the server without a login. Public proof-of-concept code exists, although it is not in the U.S. government catalog of vulnerabilities known to be actively exploited; treat this as an amber-priority exposure and restrict network access promptly.

What to do — in detail

Confirm exposure by identifying OmniVista 8770 Network Management System deployments and testing, from authorized network locations, whether TCP/30024 is reachable and responds to GIOP queries. The affected releases are 2.0 through 3.0; no vendor fixed version or supported upgrade target is available in the findings, so obtain written guidance from the vendor before attempting an upgrade.

If patching cannot be completed, place the server behind firewall rules that permit TCP/30024 only from explicitly approved management hosts, with no internet or untrusted-network access. Review system and application records for unexpected job creation, command execution, new administrative activity, and unusual connections to port 30024. This CVE is not listed in CISA KEV, so there is no CISA remediation due date.

Technical context

CVE-2016-9796 is CVSS 9.8 Critical (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). It is an unauthenticated network attack against GIOP-accessible ORB interfaces on TCP/30024, involving authentication bypass (CWE-287) and improper access control (CWE-264), leading to arbitrary OS command execution with full administrative privileges. Two public GitHub PoCs are known. EPSS is 13.4% (96th percentile) and falling; it is not listed in CISA KEV, and the findings do not confirm exploitation in the wild.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.