CVE-2016-4385

7.3HIGH

Key Information:

Vendor
HP
Status
Network Automation
Vendor
CVE Published:
29 September 2016

Summary

The RMI service in HP Network Automation Software 9.1x, 9.2x, 10.0x before 10.00.02.01, and 10.1x before 10.11.00.01 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) and Commons BeanUtils libraries.

References

https://h20566.www2.hpe.com/hpsc/doc/public/display?docId...
x_refsource_CONFIRM
http://www.zerodayinitiative.com/advisories/ZDI-16-523/
x_refsource_MISC
https://www.tenable.com/security/research/tra-2016-27
x_refsource_MISC

EPSS Score

14% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.3
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.