Security News > 2020 > December > HPE discloses critical zero-day in server management software
Hewlett Packard Enterprise has disclosed a zero-day bug in the latest versions of its proprietary HPE Systems Insight Manager software for Windows and Linux.
HPE SIM is a management and remote support automation solution for multiple HPE servers, storage, and networking products including but not limited to HPE ProLiant Gen10 and HPE ProLiant Gen9 Servers.
The vulnerability, reported by Harrison Neal through Trend Micro's Zero Day Initiative, is tracked as CVE-2020-7200 and it affects HPE Systems Insight Manager 7.6.x. CVE-2020-7200 was rated by HPE as a critical severity security flaw that allows attackers with no privileges to exploit it as part of low complexity attacks that don't require user interaction.
While HPE SIM comes with support for both Linux and Windows operating systems, HPE only issued mitigation info to block attacks against Windows systems.
According to HPE, once the mitigation measures will be taken, HPE SIM users will no longer be able to use the federated search feature.
News URL
Related news
- Rackspace internal monitoring web servers hit by zero-day (source)
- Critical Zimbra RCE flaw exploited to backdoor servers using emails (source)
- Zero-Day Alert: Three Critical Ivanti CSA Vulnerabilities Actively Exploited (source)
- GitHub Patches Critical Flaw in Enterprise Server Allowing Unauthorized Instance Access (source)
- VMware Releases vCenter Server Update to Fix Critical RCE Vulnerability (source)
- VMware fixes critical vCenter Server RCE bug – again! (CVE-2024-38812) (source)
- VMware fixes bad patch for critical vCenter Server RCE flaw (source)
- Fortinet warns of new critical FortiManager flaw used in zero-day attacks (source)
- Week in review: Fortinet patches critical FortiManager 0-day, VMware fixes vCenter Server RCE (source)
- Hackers target critical zero-day vulnerability in PTZ cameras (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-12-18 | CVE-2020-7200 | Unspecified vulnerability in HP Systems Insight Manager 7.6 A potential security vulnerability has been identified in HPE Systems Insight Manager (SIM) version 7.6. | 9.8 |