CVE-2023-26294

Published: Jun 12, 2023Modified: Jan 6, 2025

7.8

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

Previous versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges.

Affected (11)

Products: Hp: Hp Device Manager

1 product

Hp Device Manager

Configuration A

11 vulnerable

Vulnerable Software	Affected Versions
Hp Hp Device Manager	Version 5.0.3
Hp Hp Device Manager	Version 5.0.4
Hp Hp Device Manager	Version 5.0.5
Hp Hp Device Manager	Version 5.0.6
Hp Hp Device Manager	Version 5.0.7.1
Hp Hp Device Manager	Version 5.0.7
Hp Hp Device Manager	Version 5.0.8
Hp Hp Device Manager	Version 5.0.9
Hp Hp Device Manager	Version 5.0
Hp Hp Device Manager	Version 5.0 sp1
Hp Hp Device Manager	Version 5.0 sp2

Related CWEs

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (2)

https://support.hp.com/us-en/document/ish_7974907-7974931-16/hpsbhf03842

Source: hp-security-alert@hp.com

Vendor Advisory

https://support.hp.com/us-en/document/ish_7974907-7974931-16/hpsbhf03842

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.