Multiple vulnerabilities in HPE iMC PLAT
| Risk | High |
| Patch available | YES |
| Number of vulnerabilities | 3 |
| CVE-ID | CVE-2017-8980 CVE-2017-8981 CVE-2017-8982 |
| CWE-ID | CWE-200 CWE-264 |
| Exploitation vector | Network |
| Public exploit | Public exploit code for vulnerability #3 is available. |
| Vulnerable software Subscribe |
HPE iMC PLAT Hardware solutions / Routers & switches, VoIP, GSM, etc |
| Vendor | HPE |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
1) Information disclosure
EUVDB-ID: #VU10220
Risk: Low
CVSSv3.1: 4.6 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-8980
CWE-ID:
CWE-200 - Information exposure
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to obtain potentially sensitive information.
The vulnerability exists in HPE Intelligent Management Center (iMC) PLAT due to an unspecified condition. A remote attacker can gain access to arbitrary data that can be used to conduct further attacks.
MitigationUpdate to version 7.3 E0506P07.
Vulnerable software versionsHPE iMC PLAT: 7.3 E0504P2
CPE2.3 External linkshttp://support.hpe.com/hpsc/doc/public/display?docId=hpesbhf03810en_us
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Remote code execution
EUVDB-ID: #VU10259
Risk: High
CVSSv3.1: 8.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-8981
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
Description
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists in HPE Intelligent Management Center (iMC) PLAT due to unspecified condition . A remote attacker can execute arbitrary code ans compromise the vulnerable system.
Update to version 7.3 E0506P07.
Vulnerable software versionsHPE iMC PLAT: 7.3 E0504P2
CPE2.3 External linkshttp://support.hpe.com/hpsc/doc/public/display?docId=hpesbhf03813en_us
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Information disclosure
EUVDB-ID: #VU10258
Risk: Low
CVSSv3.1: 6.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C]
CVE-ID: CVE-2017-8982
CWE-ID:
CWE-200 - Information exposure
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to obtain potentially sensitive information.
The vulnerability exists in HPE Intelligent Management Center (iMC) PLAT due to improper authentication. A remote attacker can bypass authentication and gain access to important data.
MitigationUpdate to version 7.3 E0506P07.
Vulnerable software versionsHPE iMC PLAT: 7.3 E0504P2
CPE2.3 External linkshttp://support.hpe.com/hpsc/doc/public/display?docId=hpesbhf03809en_us
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.
