PT-2019-4455 · Hewlett Packard · Hp Thinpro Linux

Published 2019-11-20 · Updated 2020-08-24 · CVE-2019-16287

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HP ThinPro Linux versions 6.2 through 7.1

Description The issue is related to insecure privilege management, allowing an attacker to create a file on the local file system that puts the device in Administrative Mode. This enables the attacker to execute commands with elevated privileges. The vulnerability can be exploited to gain privileged access and execute arbitrary code with increased privileges.

Recommendations For HP ThinPro Linux versions 6.2 through 7.1, consider restricting access to the local file system to prevent the creation of files that could put the device in Administrative Mode, until a patch is available. As a temporary workaround, monitor the device for any unexpected files or changes in the file system that could indicate an attempt to exploit this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2020-00242

CVE-2019-16287

Affected Products

Hp Thinpro Linux

References · 6

• https://bdu.fstec.ru/vul/2020-00242 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16287 · Vendor Advisory
• https://support.hp.com/us-en/document/c06509350 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-16287 · Security Note
• http://seclists.org/fulldisclosure/2020/Mar/38 · Note
• http://packetstormsecurity.com/files/156899/HP-ThinPro-6.x-7.x-Privilege-Escalation.html · Note