Security News > 2020 > December > HPE discloses critical zero-day in server management software
Hewlett Packard Enterprise has disclosed a zero-day bug in the latest versions of its proprietary HPE Systems Insight Manager software for Windows and Linux.
HPE SIM is a management and remote support automation solution for multiple HPE servers, storage, and networking products including but not limited to HPE ProLiant Gen10 and HPE ProLiant Gen9 Servers.
The vulnerability, reported by Harrison Neal through Trend Micro's Zero Day Initiative, is tracked as CVE-2020-7200 and it affects HPE Systems Insight Manager 7.6.x. CVE-2020-7200 was rated by HPE as a critical severity security flaw that allows attackers with no privileges to exploit it as part of low complexity attacks that don't require user interaction.
While HPE SIM comes with support for both Linux and Windows operating systems, HPE only issued mitigation info to block attacks against Windows systems.
According to HPE, once the mitigation measures will be taken, HPE SIM users will no longer be able to use the federated search feature.
News URL
Related news
- Microsoft Issues Patches for 90 Flaws, Including 10 Critical Zero-Days (source)
- GitHub Enterprise Server vulnerable to critical auth bypass flaw (source)
- You probably want to patch this critical GitHub Enterprise Server bug now (source)
- GitHub Patches Critical Security Flaw in Enterprise Server Granting Admin Privileges (source)
- Critical GitHub Enterprise Server auth bypass flaw fixed (CVE-2024-6800) (source)
- Volt Typhoon Hackers Exploit Zero-Day Vulnerability in Versa Director Servers Used by MSPs, ISPs (source)
- Ivanti fixes critical vulnerabilities in Endpoint Management (CVE-2024-29847) (source)
- Broadcom fixes critical RCE bug in VMware vCenter Server (source)
- Critical VMware vCenter Server bugs fixed (CVE-2024-38812) (source)
- Week in review: Critical VMware vCenter Server bugs fixed, Apple releases iOS 18 (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-12-18 | CVE-2020-7200 | Unspecified vulnerability in HP Systems Insight Manager 7.6 A potential security vulnerability has been identified in HPE Systems Insight Manager (SIM) version 7.6. | 7.5 |