Vulnerability record · CVE-2016-6599 · published 30 January 2018
CVE-2016-6599: Bmc track-it\! vulnerability
Bmc · Track It\!
BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting configuration service (ConfigurationService) on port 9010. This service contains a method that can be used to retrieve a configuration file that contains the application database name, username and password as well as the domain administrator username and password. These are encrypted with a fixed key and IV ("NumaraIT") using the DES algorithm. The domain administrator username and password can only be obtained if the Self-Service component is enabled, which is the most common scenario in enterprise deployments.
Description
BMC Track-It! 11.4 before Hotfix 3 exposes an unauthenticated .NET remoting configuration service (ConfigurationService) on port 9010. This service contains a method that can be used to retrieve a configuration file that contains the application database name, username and password as well as the domain administrator username and password. These are encrypted with a fixed key and IV ("NumaraIT") using the DES algorithm. The domain administrator username and password can only be obtained if the Self-Service component is enabled, which is the most common scenario in enterprise deployments.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://packetstormsecurity.com/files/146110/BMC-Track-It-11.4-Code-Execution-Information-Disclosure.html | ExploitThird Party AdvisoryVDB Entry |
| http://seclists.org/fulldisclosure/2018/Jan/92 | ExploitMailing ListTechnical DescriptionThird Party Advisory |
| https://communities.bmc.com/community/bmcdn/bmc_track-it/blog/2016/01/04/track-it-security-advisory-24-dec-2015 | Vendor Advisory |
| https://github.com/pedrib/PoC/blob/master/advisories/bmc-track-it-11.4.txt | ExploitThird Party Advisory |
| http://packetstormsecurity.com/files/146110/BMC-Track-It-11.4-Code-Execution-Information-Disclosure.html | ExploitThird Party AdvisoryVDB Entry |
| http://seclists.org/fulldisclosure/2018/Jan/92 | ExploitMailing ListTechnical DescriptionThird Party Advisory |
| https://communities.bmc.com/community/bmcdn/bmc_track-it/blog/2016/01/04/track-it-security-advisory-24-dec-2015 | Vendor Advisory |
| https://github.com/pedrib/PoC/blob/master/advisories/bmc-track-it-11.4.txt | ExploitThird Party Advisory |
Track CVE-2016-6599 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2016-6599), CISA KEV, FIRST EPSS (scores of 2026-09-29). This page is refreshed as NVD updates the record.
