PT-2002-1320 · Hewlett Packard · Hp Advancestack Hubs

Published 2002-05-29 · Updated 2016-10-18 · CVE-2002-0250

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions HP AdvanceStack hubs J3200A through J3210A with firmware version A.03.07 and earlier

Description The web configuration utility in the affected HP AdvanceStack hubs allows unauthorized users to bypass authentication. This can be achieved by making a direct HTTP request to the "web access.html" file. As a result, an unauthorized user can change the switch's configuration and modify the administrator password.

Recommendations For HP AdvanceStack hubs J3200A through J3210A with firmware version A.03.07 and earlier, consider restricting access to the web configuration utility until a patch is available. As a temporary workaround, avoid using the web access.html file for configuration changes.

Exploit

Fix

Related Identifiers

CVE-2002-0250

Affected Products

Hp Advancestack Hubs

References · 6

• 🔥 https://exploit-db.com/exploits/21285 · Exploit
• 🔥 http://securityfocus.com/bid/4062 · Exploit
• http://iss.net/security_center/static/8124.php · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2002-0250 · Security Note
• http://online.securityfocus.com/advisories/3870 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=101318469216213&w=2 · Note