Improper access control in HPE Synergy Servers

1) Improper access control

EUVDB-ID: #VU72448

Risk: Low

CVSSv4.0: 4.5 [CVSS:4.0/AV:A/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-21216

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote user to gain unauthorized access to otherwise restricted functionality.

The vulnerability exists due to improper access restrictions in out-of-band management in Intel processors. A remote privileged user on the local network can bypass implemented security restrictions and gain unauthorized access to the application.

Mitigation

Install update from vendor's website.

Vulnerable software versions

HPE Synergy 480 Gen10 Compute Module: before 1.72_02-02-2023

CPE2.3

• cpe:2.3:h:hpe:hpe_synergy_480_gen10_compute_module:*:*:*:*:*:*:*:*

External links

https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf04433en_us

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.