External risk intelligence

Linknat VOS SQL Injection via Login

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2016-20096

The vulnerability exists in the login endpoint of a VoIP billing software, which is a public-facing service by design. Access to the login page is a standard, unauthenticated network requirement for users and administrators, making the vulnerable interface directly reachable via the internet in typical deployments.

SQL Injection

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses an unauthenticated SQL injection vulnerability in Linknat VOS3000 and VOS2009 software. The flaw allows remote attackers to execute arbitrary SQL commands by manipulating the login request, potentially leading to the extraction of sensitive data like plaintext credentials with administrative privileges. The main concern is confirming relevance and exposure, as the vulnerability lies in a public-facing login interface.

Unauthorized access to sensitive data.
Affects public-facing login systems.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can exploit this vulnerability by sending a specially crafted POST request to the login endpoint. This request manipulates the 'name' parameter to inject malicious SQL code. If successful, the attacker can then retrieve injected query results from a subsequent session request, potentially gaining access to plaintext credentials and other sensitive database information with high-level privileges.

No authentication required.
Inject SQL via login form.
Read sensitive database content.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated SQL injection in the login endpoint could allow remote attackers to execute arbitrary SQL commands. This could lead to the extraction of plaintext credentials and other sensitive database content by manipulating the 'name' parameter and retrieving injected query results.

Database credentials and content.
Via unauthenticated POST request to login.
Disclosure of sensitive information.

Operational Fix

Recommended remediation, mitigation, and detection steps

Linknat VOS3000 and VOS2009 are susceptible to an unauthenticated SQL injection vulnerability in their login endpoint. This allows remote attackers to execute arbitrary SQL commands and extract sensitive data, including plaintext credentials. Action should be initiated by identifying all instances of the affected software, assessing their business criticality and network exposure, and then coordinating remediation with the accountable teams.

Identify affected systems and accountable owners.
Verify network exposure and business criticality.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Linknat VOS3000 and VOS2009?

Linknat VOS3000 and VOS2009 are software platforms used primarily for VoIP billing and carrier-grade switching. These systems manage call routing, rate calculation, and customer accounts for telecommunications providers. Because they handle sensitive billing and account data, they are foundational components in VoIP network infrastructure.

What does CVE-2016-20096 mean?

CVE-2016-20096 is a SQL injection vulnerability (CWE-89). It occurs when the software improperly sanitizes input before including it in a database query. In this specific case, the vulnerability allows an attacker to manipulate SQL commands to bypass security controls and retrieve database content, including administrative-level credentials, directly through the login interface.

How is this SQL injection triggered?

An attacker triggers this vulnerability by sending a maliciously crafted POST request to the application's login endpoint. Specifically, the attacker manipulates the 'name' parameter to inject SQL commands. The issue does not stem from normal login attempts or authenticated user behavior; it is an unauthenticated flaw that requires no prior access to the system to initiate.

Is my system at risk according to Halo Surface Signal?

Yes, if your VOS3000 or VOS2009 login page is accessible from the internet. Halo Surface Signal identifies this as a high-risk scenario because VoIP billing software must typically be reachable via the network to serve its purpose. If the login portal faces the public internet, it is directly exposed to remote actors attempting this exploit.

How do I respond to this threat?

Start by identifying all deployed instances of VOS3000 and VOS2009 within your network to confirm their version and role. Assess whether these systems are reachable from external networks and evaluate the criticality of the data they store. Once mapped, coordinate with your infrastructure teams to prioritize remediation for the most exposed or sensitive deployments.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.