Vulnerability Details : CVE-2017-12557
Public exploit exists!
A Remote Code Execution vulnerability in HPE intelligent Management Center (iMC) PLAT version IMC Plat 7.3 E0504P2 and earlier was found.
Vulnerability category: Execute code
Exploit prediction scoring system (EPSS) score for CVE-2017-12557
Probability of exploitation activity in the next 30 days: 92.33%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 99 % EPSS Score History EPSS FAQ
Metasploit modules for CVE-2017-12557
-
HP Intelligent Management Java Deserialization RCE
Disclosure Date: 2017-10-03First seen: 2020-04-26exploit/windows/http/hp_imc_java_deserializeThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Intelligent Management Center. Authentication is not required to exploit this vulnerability. The specific flaw exists within the WebDMDebug
CVSS scores for CVE-2017-12557
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST |
|
9.8
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2017-12557
-
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-12557
-
http://www.securityfocus.com/bid/101152
HP Intelligent Management Center PLAT Multiple Remote Code Execution VulnerabilitiesThird Party Advisory;VDB Entry
-
https://www.exploit-db.com/exploits/45952/
HP Intelligent Management - Java Deserialization Remote Code Execution (Metasploit)Exploit;Third Party Advisory;VDB Entry
-
https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03778en_us
HPESBHF03778 rev.1 - HPE intelligent Management Center (iMC) PLAT, Remote Code ExecutionVendor Advisory
-
http://www.securitytracker.com/id/1039495
HPE Intelligent Management Center PLAT Multiple Flaws Let Remote Users Deny Service and Execute Arbitrary Code - SecurityTrackerThird Party Advisory;VDB Entry
Products affected by CVE-2017-12557
- cpe:2.3:a:hp:intelligent_management_center:*:*:*:*:*:*:*:*
- cpe:2.3:a:hp:intelligent_management_center:7.3:e0504p2:*:*:*:*:*:*