Multiple Vulnerabilities In HP Device Manager – Expert Insight

HP recently published a security bulletin to address multiple vulnerabilities in HP Device Manager, software that’s used to manage HP Thin Clients remotely. A combination of the three vulnerabilities could allow an attacker to gain remote command execution on the system through the HP Device Manager.

Subscribe
Notify of
guest

1 Expert Comment
Most Voted
Newest Oldest
Inline Feedbacks
View all comments
Satnam Narang
Satnam Narang , Senior Research Engineer
InfoSec Expert
October 8, 2020 9:56 am

HP Device Manager is a popular software solution used to manage HP Thin Clients remotely. The three vulnerabilities disclosed in HP’s recent security bulletin by themselves are notable.

However, a pair of the flaws, CVE-2020-6926 and CVE-2020-6927, when combined could allow an attacker to gain remote command execution on the vulnerable system through the HP Device Manager.

HP has so far released patches for the 5.0.x branch of HP Device Manager, so organizations using this particular branch release should upgrade to 5.0.4 as soon as possible. If an organization is using a previous version of HP Device Manager, there are mitigation steps in HP’s security bulletin that can be taken to protect against these attacks until a patch becomes available.

Last edited 2 years ago by Satnam Narang
Information Security Buzz
1
0
Would love your thoughts, please comment.x
()
x