How severe is CVE-2016-8212?

CVE-2016-8212 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2016-8212 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (77th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2016-8212?

CVE-2016-8212 affects Dell Bsafe Crypto-j. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2016-8212?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2016-8212 published?

CVE-2016-8212 was published on 2017-02-03 and last updated on 2026-06-17.

CVE-2016-8212

CVE-2016-8212 is a high-severity vulnerability in Dell Bsafe Crypto-j with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-404.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v2: 5.0
EPSS exploit prediction: 2% (77th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-404
Affected product: Dell Bsafe Crypto-j
Published: 2017-02-03
Last modified: 2026-06-17

Description

An issue was discovered in EMC RSA BSAFE Crypto-J versions prior to 6.2.2. There is an Improper OCSP Validation Vulnerability. OCSP responses have two time values: thisUpdate and nextUpdate. These specify a validity period; however, both values are optional. Crypto-J treats the lack of a nextUpdate as indicating that the OCSP response is valid indefinitely instead of restricting its validity for a brief period surrounding the thisUpdate time. This vulnerability is similar to the issue described in CVE-2015-4748.

Frequently asked questions

What is CVE-2016-8212?: An issue was discovered in EMC RSA BSAFE Crypto-J versions prior to 6.2.2. There is an Improper OCSP Validation Vulnerability. OCSP responses have two time values: thisUpdate and nextUpdate. These specify a validity period; however, both values are optional. Crypto-J treats the lack of a nextUpdate as indicating that the OCSP response is valid indefinitely instead of restricting its validity for a brief period surrounding the thisUpdate time. This vulnerability is similar to the issue described in CVE-2015-4748.
How severe is CVE-2016-8212?: CVE-2016-8212 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2016-8212 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (77th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2016-8212?: CVE-2016-8212 affects Dell Bsafe Crypto-j. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2016-8212?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2016-8212 published?: CVE-2016-8212 was published on 2017-02-03 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:dell:bsafe_crypto-j:*:*:*:*:*:*:*:*

More vulnerabilities in Dell Bsafe Crypto-j

CVE-2022-34381 — Critical (CVSS 9.1): Dell BSAFE SSL-J version 7.0 and all versions prior to 6.5, and Dell BSAFE Crypto-J versions prior to 6.2.6.1 contain…
CVE-2019-3740 — Medium (CVSS 6.5): RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to an Information Exposure Through Timing Discrepancy…
CVE-2019-3739 — Medium (CVSS 6.5): RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to Information Exposure Through Timing Discrepancy…
CVE-2019-3738 — Medium (CVSS 6.5): RSA BSAFE Crypto-J versions prior to 6.2.5 are vulnerable to a Missing Required Cryptographic Step vulnerability. A…
CVE-2025-26333 — Medium (CVSS 5.9): Dell BSAFE Crypto-J generates an error message that includes sensitive information about its environment and associated…
CVE-2018-11070 — Medium (CVSS 5.9): RSA BSAFE Crypto-J versions prior to 6.2.4 and RSA BSAFE SSL-J versions prior to 6.2.4 contain a Covert Timing Channel…

All CVEs affecting Dell Bsafe Crypto-j →

Other CWE-404 vulnerabilities

CVE-2023-24444 — Critical (CVSS 9.8): Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login.
CVE-2024-31611 — Critical (CVSS 9.1): SeaCMS 12.9 has a file deletion vulnerability via admin_template.php.
CVE-2018-8450 — High (CVSS 8.8): A remote code execution vulnerability exists when Windows Search handles objects in memory, aka "Windows Search Remote…
CVE-2026-11317 — High (CVSS 8.7): A denial of service security issue exists in the affected product. The security issue stems from a fault occurring when…
CVE-2022-25762 — High (CVSS 8.6): If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on…
CVE-2020-26070 — High (CVSS 8.6): A vulnerability in the ingress packet processing function of Cisco IOS XR Software for Cisco ASR 9000 Series…

Browse all CWE-404 vulnerabilities →