CVE-2016-20096: Linknat VOS SQL Injection Vulnerability

CVE-2016-20096 Overview

CVE-2016-20096 is an unauthenticated SQL injection vulnerability affecting Linknat VOS3000 and VOS2009 through version 2.1.2.0. The flaw resides in the login endpoint, where the name parameter in a POST request is passed to the backend database without proper sanitization. Remote attackers can inject arbitrary SQL statements and retrieve the query results from a subsequent session request. Exploitation runs with database administrator (DBA) privileges, enabling extraction of plaintext credentials and other sensitive database content. The vulnerability is tracked under [CWE-89] and carries a CVSS 4.0 score of 9.3.

Critical Impact
Unauthenticated remote attackers can execute arbitrary SQL with DBA privileges against the VoIP softswitch database, leading to credential theft and full backend compromise.

Affected Products

Linknat VOS3000 through version 2.1.2.0
Linknat VOS2009 through version 2.1.2.0
VoIP softswitch deployments exposing login.jsp to untrusted networks

Discovery Timeline

2026-07-21 - CVE-2016-20096 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2016-20096

Vulnerability Analysis

The vulnerability is a classic SQL injection in the authentication workflow of Linknat's VoIP softswitch platforms. When a client submits a POST request to the login endpoint, the name parameter is concatenated into a backend SQL query without parameterization or escaping. Because the application executes database queries under a DBA-level account, injected statements inherit full administrative privileges over the underlying database.

A distinguishing property of this flaw is that the injected query results are not returned in the immediate login response. Instead, the application stores the tainted output in the user session, which attackers retrieve by issuing a subsequent request that reflects session data back to the client. This second-order retrieval pattern makes the flaw exploitable even when the login response body appears unremarkable.

Root Cause

The root cause is unsanitized concatenation of the name request parameter into an SQL statement executed by the login handler. The application does not use prepared statements, parameter binding, or input validation to constrain the parameter to expected authentication values. Coupled with excessive database privileges assigned to the application account, the injection becomes a full DBA-level primitive.

Attack Vector

Exploitation requires only network reachability to the management or login interface exposed by VOS3000 or VOS2009. An attacker crafts a POST request to the login endpoint containing an SQL injection payload in the name parameter, then issues a follow-up request that surfaces the session-stored query output. No credentials, user interaction, or prior access are required. Refer to the VulnCheck SQL Injection Advisory and the Packet Storm File for technical details of the request sequence.

Detection Methods for CVE-2016-20096

Indicators of Compromise

POST requests to the login endpoint (login.jsp) containing SQL keywords such as UNION, SELECT, --, or 0x in the name parameter.
Immediate follow-up GET requests to session-reflecting endpoints from the same client IP after a suspicious login attempt.
Unexpected DBA-level queries in database audit logs originating from the application service account.
Sudden read access to credential or configuration tables outside of normal administrative workflows.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the name POST parameter for SQL metacharacters and known injection patterns.
Enable database query logging and alert on statements referencing sensitive tables from the softswitch application account.
Correlate failed login attempts with subsequent session data retrieval requests from the same source address.

Monitoring Recommendations

Aggregate VOS3000 and VOS2009 web and database logs into a centralized analytics platform for cross-source correlation.
Baseline normal login traffic volume and payload size, and alert on requests with anomalously long name values.
Monitor egress from softswitch hosts for outbound data flows that could indicate credential exfiltration.

How to Mitigate CVE-2016-20096

Immediate Actions Required

Restrict network access to the VOS3000 and VOS2009 management interfaces to trusted administrative networks or VPN only.
Place the login endpoint behind a WAF configured to block SQL injection patterns in the name parameter.
Rotate all credentials stored within the VOS database, assuming prior exposure if the interface has been internet-facing.
Audit database logs and session storage for evidence of prior exploitation.

Patch Information

No vendor patch is referenced in the available advisories for versions through 2.1.2.0. Operators should contact Linknat directly via the LinkNat Overview page to obtain a supported release, and consult the VulnCheck SQL Injection Advisory for the latest remediation guidance.

Workarounds

Block external access to login.jsp at the network perimeter and expose it only through an authenticated reverse proxy.
Reduce the database account privileges used by the softswitch application from DBA to the minimum required set.
Deploy WAF signatures that reject POST bodies containing SQL keywords in the name field until an official fix is available.

bash

# Example nginx configuration to restrict login endpoint to trusted management network
location /login.jsp {
    allow 10.10.0.0/24;   # trusted admin subnet
    deny  all;
    proxy_pass http://vos_backend;
}