CVE-2016-3648

Name of the Vulnerable Software and Affected Versions Symantec Endpoint Protection Manager versions prior to 12.1 RU6 MP5

Description The issue allows remote authenticated users to bypass the Authentication Lock protection mechanism. This enables them to conduct brute-force password-guessing attacks against management-console accounts by entering data into the authorization window.

Recommendations For Symantec Endpoint Protection Manager versions prior to 12.1 RU6 MP5, update to version 12.1 RU6 MP5 or later to resolve the issue. As a temporary workaround, consider restricting access to the management console to minimize the risk of exploitation.