VDB

GCVE-110-CERTCC-2016-813296

GCVE-110-CERTCC-2016-813296
Advisory PublishedCVSS 8.8/10
Vulnetix · Advisory published April 12, 2016
The Security Account Manager Remote (SAMR) and Local Security Authority (Domain Policy) (LSAD) protocols do not properly establish Remote Procedure Call (RPC) channels, which may allow any attacker to impersonate an authenticated user or gain access to the SAM database, or launch denial of service attacks. This vulnerability is also known publicly as "Badlock".
Download JSON Open in Console

Risk Scores

CVSS 2.0
8.8/10
High · AV:N/AC:M/Au:N/C:C/I:C/A:N
certcc-cam
certcc-cam
impact0population0exploitation0widely_known0score_current0ease_of_exploitation0
certcc-vrda
certcc-vrda
d1_impact3d1_population4d1_direct_report0
certcc-cvss-temporal-env
certcc-cvss-temporal-env
temporal_score6.9remediation_levelOFreport_confidenceCenvironmental_score6.8687510697792target_distributionHenvironmental_vectorCDP:ND/TD:H/CR:ND/IR:ND/AR:ND

Aliases

CVE-2016-0128

References

Microsoft Windows and Samba may allow spoofing of authenticated users ("Badlock")
url
Microsoft Windows and Samba may allow spoofing of authenticated users ("Badlock")
url
Microsoft Windows and Samba may allow spoofing of authenticated users ("Badlock")
url
Microsoft Windows and Samba may allow spoofing of authenticated users ("Badlock")
url
Microsoft Windows and Samba may allow spoofing of authenticated users ("Badlock")
advisory
Microsoft Windows and Samba may allow spoofing of authenticated users ("Badlock")
advisory
Microsoft Windows and Samba may allow spoofing of authenticated users ("Badlock")
sighting

Browse GCVE Records

72,580 records in the GCVE database · Updated July 15, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON
$ Console Community · 100/wk Open console ›