CVE-2016-10646

CVE-2016-10646 describes a Man-in-the-Middle (MITM) vulnerability in the resourcehacker Node.js package, which wraps the Resource Hacker Windows executable. The vulnerability arises because resourcehacker downloads binary resources over unencrypted HTTP, allowing an attacker to intercept and replace the requested binary. This could lead to remote code execution (RCE) if an attacker, positioned between the user and the remote server, swaps the legitimate binary with a malicious one. The vulnerability has a CVSS v3 score of 8.1 (High), indicating a high-impact threat with network access, high confidentiality, integrity, and availability impacts, but requiring high attack complexity. Its EPSS score is low, suggesting a low probability of exploitation in the wild. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. Community discussion and media coverage for this CVE are minimal, consistent with the majority of reported vulnerabilities.