CVE-2019-11990 Auth bypass in HPE IOT and GCP
Unauthorized remote access allows attackers to view sensitive data in HPE UIoT, requiring users to upgrade to patched versions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-11990?
CVE-2019-11990 is a high-severity authentication bypass vulnerability in HPE IOT and GCP, published on 19 Jul 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Security vulnerabilities in HPE UIoT versions 1.6, 1.5, 1.4.2, 1.4.1, 1.4.0, and 1.2.4.2 could allow unauthorized remote access and access to sensitive data. HPE has addressed this issue in HPE UIoT: * For customers with release UIoT 1.6, fixes are made available with 1.6 RP603 * For customers with release UIoT 1.5, fixes are made available with 1.5 RP503 HF3 * For customers with release older than 1.5, such as 1.4.0, 1.4.1, 1.4.2 and 1.2.4.2, the resolution will be to upgrade to 1.5 RP503 HF3 or 1.6 RP603 Customers are requested to upgrade to the updated versions or contact HPE support for further assistance.
Which versions are affected by CVE-2019-11990?
It affects 1 product.
Products include Hp Universal Internet of Things.
How do I fix CVE-2019-11990?
No fix has been published for CVE-2019-11990 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-11990 being exploited?
There is no known exploitation of CVE-2019-11990 in the wild and no public exploit code.
Other vulnerabilities in HPE IOT and GCP
Sources
Also known as GHSA-2rrf-398j-6q9g.