CVE-2016-2114

CVE-2016-2114, also known as "Badlock," is a vulnerability in the SMB1 protocol implementation of Samba versions 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2. This flaw prevents Samba from enforcing the "server signing = mandatory" setting, making it susceptible to man-in-the-middle (MitM) attacks. An attacker could exploit this to spoof SMB servers by altering the client-server data stream, leading to a high impact on integrity (I:H) with no impact on confidentiality or availability. The vulnerability has a CVSSv3 score of 5.9 (MEDIUM) due to its network-based attack vector (AV:N) and high attack complexity (AC:H). While it received media coverage and some community discussion, there is no public exploit code available (Metasploit, Nuclei, ExploitDB) and it is not listed in CISA's KEV catalog, indicating no active exploitation.