CVE Vulnerability

CVE-2020-7131

This document describes a security vulnerability in Blade Maintenance Entity, Integrated Maintenance Entity and Maintenance Entity products. All J/H-series NonStop systems have a security vulnerability associated with an open UDP port 17185 on the Maintenance LAN which could result in information disclosure, denial-of-service attacks or local memory corruption against the affected system and a complete control of the system may also be possible. This vulnerability exists only if one gains access to the Maintenance LAN to which Blade Maintenance Entity, Integrated Maintenance Entity or Maintenance Entity product is connected. **Workaround:** Block the UDP port 17185(In the Maintenance LAN Network Switch/Firewall). Fix: Install following SPRs, which are already available: * T1805A01^AAI (Integrated Maintenance Entity) * T4805A01^AAZ (Blade Maintenance Entity). These SPRs are also usable with the following RVUs: * J06.19.00 ? J06.23.01. No fix planned for the following RVUs: J06.04.00 ? J06.18.01. No fix planned for H-Series NonStop systems. No fix planned for the product T2805 (Maintenance Entity).

9 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8 / Impact : 10

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

Scope

9 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 2.3 / Impact : 6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03996en_us Mitigation Vendor Advisory
Configurations

Configuration 1

cpe:2.3:a:hp:maintenance_entity:*:*:*:*:*:*:*:*
cpe:2.3:a:hp:integrated_maintenance_entity:*:*:*:*:*:*:*:*
cpe:2.3:a:hp:blade_maintenance_entity:*:*:*:*:*:*:*:*
Information

Published : 2020-04-24 06:15

Updated : 2021-07-21 11:39

NVD link : CVE-2020-7131

Mitre link : CVE-2020-7131

Products Affected
No products.
CWE
CWE-787