HPE discloses critical zero-day in server management software

guest · Dec 16, 2020

HPE discloses critical zero-day in server management software
December 16, 2020
https://www.bleepingcomputer.com/ne...tical-zero-day-in-server-management-software/

Hewlett Packard Enterprise (HPE) has disclosed a zero-day bug in the latest versions of its proprietary HPE Systems Insight Manager (SIM) software for Windows and Linux.

HPE SIM is a management and remote support automation solution for multiple HPE servers, storage, and networking products including but not limited to HPE ProLiant Gen10 and HPE ProLiant Gen9 Servers.
Click to expand...

Critical severity RCE vulnerability
The vulnerability, reported by Harrison Neal through Trend Micro's Zero Day Initiative, is tracked as CVE-2020-7200 and it affects HPE Systems Insight Manager (SIM) 7.6.x.

CVE-2020-7200 was rated by HPE as a critical severity (9.8/10) security flaw that allows attackers with no privileges to exploit it as part of low complexity attacks that don't require user interaction.
Click to expand...

Available mitigation measures
Hewlett Packard Enterprise has included mitigation info in the CVE-2020-7200 security advisory which requires disabling the "Federated Search" and "Federated CMS Configuration" features that allowed the vulnerability.

"A complete fix that prevents the remote code execution vulnerability will be made available in a future release," the security advisory reads.
Click to expand...

Log in or Sign up

HPE discloses critical zero-day in server management software

guest Guest

Log in or Sign up

HPE discloses critical zero-day in server management software

guest Guest

Useful Searches