How severe is CVE-2010-2116?

CVE-2010-2116 has a CVSS 2.0 base score of 6.5, rated medium severity.

Is CVE-2010-2116 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (81st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2010-2116?

CVE-2010-2116 primarily affects Mcafee Email Gateway. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2010-2116?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2010-2116 published?

CVE-2010-2116 was published on 2010-05-28 and last updated on 2026-06-16.

CVE-2010-2116

CVE-2010-2116 is a medium-severity vulnerability in Mcafee Email Gateway with a CVSS 2.0 base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-732.

Key facts

Severity: Medium (CVSS 2.0 base score 6.5)
EPSS exploit prediction: 2% (81st percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-732
Affected product: Mcafee Email Gateway
Published: 2010-05-28
Last modified: 2026-06-16

Description

The web interface in McAfee Email Gateway (formerly IronMail) 6.7.1 allows remote authenticated users, with only Read privileges, to gain Write privileges to modify configuration via the save action in a direct request to admin/systemWebAdminConfig.do.

Frequently asked questions

What is CVE-2010-2116?: The web interface in McAfee Email Gateway (formerly IronMail) 6.7.1 allows remote authenticated users, with only Read privileges, to gain Write privileges to modify configuration via the save action in a direct request to admin/systemWebAdminConfig.do.
How severe is CVE-2010-2116?: CVE-2010-2116 has a CVSS 2.0 base score of 6.5, rated medium severity.
Is CVE-2010-2116 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (81st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2010-2116?: CVE-2010-2116 primarily affects Mcafee Email Gateway. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2010-2116?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2010-2116 published?: CVE-2010-2116 was published on 2010-05-28 and last updated on 2026-06-16.

References

Affected products (2)

cpe:2.3:a:mcafee:email_gateway:6.7.1:*:*:*:*:*:*:*
cpe:2.3:a:mcafee:secure_mail:6.7.1:*:*:*:*:*:*:*

More vulnerabilities in Mcafee Email Gateway

CVE-2013-7104 — Critical (CVSS 9.0): McAfee Email Gateway 7.6 allows remote authenticated administrators to execute arbitrary commands by specifying them in…
CVE-2013-7103 — Critical (CVSS 9.0): McAfee Email Gateway 7.6 allows remote authenticated administrators to execute arbitrary commands via shell…
CVE-2013-6349 — High (CVSS 8.5): McAfee Email Gateway (MEG) 7.0 before 7.0.4 and 7.5 before 7.5.1 allows remote authenticated users to execute arbitrary…
CVE-2009-1348 — High (CVSS 7.6): The AV engine before DAT 5600 in McAfee VirusScan, Total Protection, Internet Security, SecurityShield for Microsoft…
CVE-2012-4595 — High (CVSS 7.5): McAfee Email and Web Security (EWS) 5.5 through Patch 6 and 5.6 through Patch 3, and McAfee Email Gateway (MEG) 7.0.0…
CVE-2012-4581 — Medium (CVSS 6.8): McAfee Email and Web Security (EWS) 5.x before 5.5 Patch 6 and 5.6 before Patch 3, and McAfee Email Gateway (MEG) 7.0…

All CVEs affecting Mcafee Email Gateway →

Other CWE-732 (Incorrect Permission Assignment for Critical Resource) vulnerabilities

CVE-2026-9508 — Critical (CVSS 10.0): Incorrect permission settings on a critical resource in Suprema BioStar 2 (versions 2.9.3 through 2.9.11) that allow…
CVE-2025-14988 — Critical (CVSS 10.0): A security issue has been identified in ibaPDA that could allow unauthorized actions on the file system under certain…
CVE-2025-69426 — Critical (CVSS 10.0): The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) contain hardcoded credentials for an operating…
CVE-2025-12004 — Critical (CVSS 10.0): Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown…
CVE-2014-125121 — Critical (CVSS 10.0): Array Networks vAPV (version 8.3.2.17) and vxAG (version 9.2.0.34) appliances are affected by a privilege escalation…
CVE-2025-46093 — Critical (CVSS 9.9): LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to…

Browse all CWE-732 (Incorrect Permission Assignment for Critical Resource) vulnerabilities →