Security readout for executives and security teams
Plain-English summary
OpenNMS could save unsafe text supplied by a monitored SNMP device and later run it in an administrator's browser. This is a stored cross-site scripting issue, fixed in OpenNMS 18.0.2. The main risk is compromise of sensitive web UI data when a user views affected SNMP details.
Executive priority
Treat this as a high-priority legacy remediation if OpenNMS 18.0.1 or older remains in use. The fix has been available since September 20, 2016, so unresolved exposure likely indicates outdated infrastructure or weak monitoring-system maintenance.
Technical view
OpenNMS 18.0.1 and earlier insufficiently filtered SNMP agent supplied sysName and sysContact values. Malicious stored content could execute when a web UI user viewed the data. CVSS 3.1 is 7.1, reflecting network attackability, low complexity, no attacker privileges, required user interaction, high confidentiality impact, and low integrity impact.
Likely exposure
Exposure is most likely in legacy OpenNMS deployments at version 18.0.1 or earlier that poll SNMP agents controlled by untrusted parties, compromised devices, or devices outside strict operational control. Systems already upgraded to 18.0.2 or later are not described as affected in the source bundle.
Exploitation context
The provided bundle does not show CISA KEV listing or cited evidence of active exploitation. Exploitation requires attacker influence over SNMP sysName or sysContact data and a web UI user viewing the stored data. No exploit code or weaponization details are needed to assess exposure.
Researcher notes
The source bundle attributes the flaw to insufficient filtering of SNMP agent supplied sysName and sysContact data and maps it to CWE-79. Evidence supports a stored XSS condition with user interaction. The bundle names OpenNMS 18.0.2 as fixed but does not provide KEV or active exploitation evidence.
Mitigation direction
- Upgrade OpenNMS to version 18.0.2 or later.
- Review OpenNMS vendor guidance and the referenced fix for deployment details.
- Limit SNMP polling to trusted, managed devices where feasible.
- Restrict OpenNMS web UI access to authorized administrative users.
- Review stored SNMP identity fields for unexpected or unsafe content.
Validation and detection
- Inventory all OpenNMS instances and confirm their running versions.
- Flag OpenNMS 18.0.1 and earlier for remediation.
- Identify whether monitored SNMP agents are trusted and operationally controlled.
- Confirm the OpenNMS 18.0.2 fix or later equivalent is deployed.
- Review logs or UI data for suspicious sysName or sysContact values.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2016-6556 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.1 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N2.84.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.1HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.rapid7.com/blog/post/2016/11/15/r7-2016-24-opennms-stored-xss-via-snmp-cve-2016-6555-cve-2016-6556/CVE reference · x_refsource_MISC
- https://github.com/OpenNMS/opennms/pull/1019CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.