How severe is CVE-2013-2566?

CVE-2013-2566 has a CVSS 3.x base score of 5.9, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2013-2566 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 84% (100th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2013-2566?

CVE-2013-2566 primarily affects Oracle Communications Application Session Controller. In total, 23 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2013-2566?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2013-2566 published?

CVE-2013-2566 was published on 2013-03-15 and last updated on 2026-06-16.

CVE-2013-2566

CVE-2013-2566 is a medium-severity vulnerability in Oracle Communications Application Session Controller with a CVSS 3.x base score of 5.9. Its EPSS exploit-prediction score of 84% places it in the 100th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-326.

Key facts

Severity: Medium (CVSS 3.x base score 5.9)
CVSS v2: 4.3
EPSS exploit prediction: 84% (100th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-326
Affected product: Oracle Communications Application Session Controller
Published: 2013-03-15
Last modified: 2026-06-16

Description

The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext.

Frequently asked questions

What is CVE-2013-2566?: The RC4 algorithm, as used in the TLS protocol and SSL protocol, has many single-byte biases, which makes it easier for remote attackers to conduct plaintext-recovery attacks via statistical analysis of ciphertext in a large number of sessions that use the same plaintext.
How severe is CVE-2013-2566?: CVE-2013-2566 has a CVSS 3.x base score of 5.9, rated medium severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2013-2566 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 84% (100th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2013-2566?: CVE-2013-2566 primarily affects Oracle Communications Application Session Controller. In total, 23 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2013-2566?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2013-2566 published?: CVE-2013-2566 was published on 2013-03-15 and last updated on 2026-06-16.

References

Affected products (23)

cpe:2.3:a:oracle:communications_application_session_controller:*:*:*:*:*:*:*:*
cpe:2.3:a:oracle:http_server:11.1.1.7.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:http_server:11.1.1.9.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:http_server:12.1.3.0.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:http_server:12.2.1.1.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:http_server:12.2.1.2.0:*:*:*:*:*:*:*
cpe:2.3:o:oracle:integrated_lights_out_manager_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:fujitsu:sparc_enterprise_m3000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:fujitsu:sparc_enterprise_m4000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:fujitsu:sparc_enterprise_m5000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:fujitsu:sparc_enterprise_m8000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:fujitsu:sparc_enterprise_m9000_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:fujitsu:m10-1_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:fujitsu:m10-4_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:fujitsu:m10-4s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:13.04:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:seamonkey:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird:*:*:*:*:*:*:*:*
cpe:2.3:a:mozilla:thunderbird_esr:*:*:*:*:*:*:*:*

More vulnerabilities in Oracle Communications Application Session Controller

CVE-2015-0235 — Critical (CVSS 10.0): Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18,…
CVE-2020-10683 — Critical (CVSS 9.8): dom4j before 2.0.3 and 2.1.x before 2.1.3 allows external DTDs and External Entities by default, which might enable XXE…
CVE-2018-1000613 — Critical (CVSS 9.8): Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60…
CVE-2016-8735 — Critical (CVSS 9.8): Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before…
CVE-2021-2351 — High (CVSS 8.3): Vulnerability in the Advanced Networking Option component of Oracle Database Server. Supported versions that are…
CVE-2020-11987 — High (CVSS 8.2): Apache Batik 1.13 is vulnerable to server-side request forgery, caused by improper input validation by the…

All CVEs affecting Oracle Communications Application Session Controller →

Other CWE-326 (Inadequate Encryption Strength) vulnerabilities

CVE-2026-44523 — Critical (CVSS 10.0): Note Mark is an open-source note-taking application. Prior to 0.19.4, no minimum length or entropy is enforced on the…
CVE-2020-6966 — Critical (CVSS 10.0): In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information…
CVE-2014-9199 — Critical (CVSS 10.0): The Clorius Controls Java web client before 01.00.0009g allows remote attackers to discover credentials by sniffing the…
CVE-2018-25272 — Critical (CVSS 9.8): ELBA5 5.8.0 contains a remote code execution vulnerability that allows attackers to obtain database credentials and…
CVE-2025-12478 — Critical (CVSS 9.8): Non-Compliant TLS Configuration.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5 .
CVE-2022-24116 — Critical (CVSS 9.8): Certain General Electric Renewable Energy products have inadequate encryption strength. This affects iNET and iNET II…

Browse all CWE-326 (Inadequate Encryption Strength) vulnerabilities →