CVE-2019-11995 Auth bypass in HPE IOT + GCP
Unauthorized remote access allows attackers to view sensitive data in HPE UIoT, requiring an upgrade to the latest patch.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-11995?
CVE-2019-11995 is a high-severity authentication bypass vulnerability in HPE IOT + GCP, published on 18 Dec 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Security vulnerabilities in HPE UIoT version 1.2.4.2 could allow unauthorized remote access and access to sensitive data. HPE has addressed this issue in HPE UIoT: For customers with release UIoT 1.2.4.2 fixes are made available with 1.2.4.2 RP3 HF1. For customers with release older than 1.2.4.2, such as 1.2.4.1, 1.2.4.0, the resolution will be to upgrade to 1.2.4.2 RP3 HF1 Customers are requested to upgrade to the updated versions or contact HPE support for further assistance.
Which versions are affected by CVE-2019-11995?
It affects 1 product.
Products include Hp Universal Internet of Things.
How do I fix CVE-2019-11995?
No fix has been published for CVE-2019-11995 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2019-11995 being exploited?
There is no known exploitation of CVE-2019-11995 in the wild and no public exploit code.
Other vulnerabilities in HPE IOT + GCP
Sources
Also known as GHSA-7w89-8hr4-7235.