Unauthenticated SQL Injection Risk in Linknat VOS3000 and VOS2009 Solutions
CVE-2016-20096

9.3CRITICAL

Key Information:

Vendor: Kunshi Network Technology Co., Ltd.
Status: Linknat Vos3000; Linknat Vos2009
Vendor: CVE Published:; 21 July 2026

🔔 Create Kunshi Network Technology Co., Ltd. Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2016-20096?

Linknat VOS3000 and VOS2009 versions up to 2.1.2.0 are susceptible to an unauthenticated SQL injection vulnerability via the login endpoint's name parameter. This flaw allows remote attackers to execute arbitrary SQL commands, potentially leading to unauthorized access to sensitive data. By manipulating the login form, attackers can inject malicious SQL queries and later retrieve the results, including plaintext credentials and other critical database information with elevated privileges.

Affected Version(s)

Linknat VOS2009 2.1.1.5

Linknat VOS2009 2.1.1.8

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2016-20096 - Proof of Concept