Command Injection Vulnerability in HPE Apollo 70 System Firmware
CVE-2021-25172

7.8HIGH

Key Information:

Vendor

HP
Status
HP Apollo 70 System
Vendor
CVE Published:
8 February 2021

What is CVE-2021-25172?

The firmware associated with the Baseboard Management Controller (BMC) in the HPE Apollo 70 System is susceptible to a command injection vulnerability. This flaw exists in the websetdefaultlangcfg function of the libifc.so library, allowing an attacker to manipulate commands. Exploitation of this vulnerability could lead to unauthorized access and control over firmware settings, posing significant security risks to the affected systems.

Affected Version(s)

HPE Apollo 70 System Prior to Version 3.0.14.0

References

https://support.hpe.com/hpsc/doc/public/display?docLocale...
x_refsource_MISC

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.