Local Buffer Overflow in HPE Cloudline Servers' BMC Firmware
CVE-2021-25126

7.8HIGH

Key Information:

Vendor

HP
Status
HP Cloudline Cl5800 Gen9 Server; HP Cloudline Cl5200 Gen9 Server; HP Cloudline Cl4100 Gen10 Server; HP Cloudline Cl3100 Gen10 Server; HP Cloudline Cl5800 Gen10 Server
Vendor
CVE Published:
29 January 2021

What is CVE-2021-25126?

A local buffer overflow vulnerability has been identified in the Baseboard Management Controller (BMC) firmware in several HPE Cloudline servers. This flaw exists within the spx_restservice’s downloadkvmjnlp_func function, potentially allowing an authenticated local attacker to execute arbitrary code or cause a denial of service. Users of affected server models should apply recommended updates from HPE to mitigate risks associated with this vulnerability.

Affected Version(s)

HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server Version. 1.09.0.0

HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server Version 1.07.0.0

HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server Version 1.10.0.0

References

https://support.hpe.com/hpsc/doc/public/display?docLocale...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.