CVE-2002-1147
The HTTP administration interface for HP Procurve 4000M Switch firmware before C.09.16, with stacking features and remote administration enabled, does not authenticate requests to reset the device, which allows remote attackers to cause a denial of…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (6.67%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The HTTP administration interface for HP Procurve 4000M Switch firmware before C.09.16, with stacking features and remote administration enabled, does not authenticate requests to reset the device, which allows remote attackers to cause a denial of service via a direct request to the device_reset CGI program.
- CVSS 2.0
- 7.1 HIGHAV:N/AC:M/Au:N/C:N/I:N/A:C
- EPSS
- 6.67% probability · 94th percentile
- CISA KEV
- Not listed
- Affected
- hp/procurve switch 4000m
- Source
- cve@mitre.org
References
- http://marc.info/?l=bugtraq&m=103287951910420&w=2
- http://online.securityfocus.com/advisories/4501Vendor Advisory
- http://www.iss.net/security_center/static/10172.phpVendor Advisory
- http://www.securityfocus.com/bid/5784
- http://www.tech-serve.com/research/advisories/2002/a092302-1.txt
- http://marc.info/?l=bugtraq&m=103287951910420&w=2
- http://online.securityfocus.com/advisories/4501Vendor Advisory
- http://www.iss.net/security_center/static/10172.phpVendor Advisory
- http://www.securityfocus.com/bid/5784
- http://www.tech-serve.com/research/advisories/2002/a092302-1.txt
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.