Security News > 2020 > December > HPE discloses critical zero-day in server management software
Hewlett Packard Enterprise has disclosed a zero-day bug in the latest versions of its proprietary HPE Systems Insight Manager software for Windows and Linux.
HPE SIM is a management and remote support automation solution for multiple HPE servers, storage, and networking products including but not limited to HPE ProLiant Gen10 and HPE ProLiant Gen9 Servers.
The vulnerability, reported by Harrison Neal through Trend Micro's Zero Day Initiative, is tracked as CVE-2020-7200 and it affects HPE Systems Insight Manager 7.6.x. CVE-2020-7200 was rated by HPE as a critical severity security flaw that allows attackers with no privileges to exploit it as part of low complexity attacks that don't require user interaction.
While HPE SIM comes with support for both Linux and Windows operating systems, HPE only issued mitigation info to block attacks against Windows systems.
According to HPE, once the mitigation measures will be taken, HPE SIM users will no longer be able to use the federated search feature.
News URL
Related news
- Choose your own Patch Tuesday adventure: Start with six zero day fixes, or six critical flaws (source)
- New Critical AMI BMC Vulnerability Enables Remote Server Takeover and Bricking (source)
- Critical AMI MegaRAC bug can let attackers hijack, brick servers (source)
- Mozilla Patches Critical Firefox Bug Similar to Chrome’s Recent Zero-Day Vulnerability (source)
- CentreStack RCE exploited as zero-day to breach file sharing servers (source)
- Critical flaws fixed in Nagios Log Server (source)
- Hackers Exploit Critical Craft CMS Flaws; Hundreds of Servers Likely Compromised (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-12-18 | CVE-2020-7200 | Unspecified vulnerability in HP Systems Insight Manager 7.6 A potential security vulnerability has been identified in HPE Systems Insight Manager (SIM) version 7.6. | 9.8 |