HP Network Switch up to 15.18 access control

CVSS Meta Temp Score
CVSS is a standardized scoring system to determine possibilities of attacks. The Temp Score considers temporal factors like disclosure, exploit and countermeasures. The unique Meta Score calculates the average score of different sources to provide a normalized scoring system.
Current Exploit Price (≈)
Our analysts are monitoring exploit markets and are in contact with vulnerability brokers. The range indicates the observed or calculated exploit price to be seen on exploit markets. A good indicator to understand the monetary effort required for and the popularity of an attack.
CTI Interest Score
Our Cyber Threat Intelligence team is monitoring different web sites, mailing lists, exploit markets and social media networks. The CTI Interest Score identifies the interest of attackers and the security community for this specific vulnerability in real-time. A high score indicates an elevated risk to be targeted for this vulnerability.
8.2$0-$5k0.00

Summaryinfo

A vulnerability described as critical has been identified in HP Network Switch up to 15.18. Affected by this issue is some unknown functionality. Such manipulation leads to access control. This vulnerability is traded as CVE-2015-6860. There is no exploit available. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability was found in HP Network Switch up to 15.18. It has been rated as critical. Affected by this issue is an unknown code block. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-264. Impacted is confidentiality, integrity, and availability. CVE summarizes:

HPE Network Switches with software 15.16.x and 15.17.x allow local users to bypass intended access restrictions via unspecified vectors, a different vulnerability than CVE-2015-6859.

The weakness was shared 12/11/2015 as c04920918 as confirmed security bulletin (Website). The advisory is shared for download at h20564.www2.hpe.com. This vulnerability is handled as CVE-2015-6860 since 09/10/2015. The attack needs to be approached locally. No form of authentication is required for exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1068.

Upgrading to version 15.18.0007 eliminates this vulnerability. Applying a patch is able to eliminate this problem. The best possible mitigation is suggested to be patching the affected component. A possible mitigation has been published immediately after the disclosure of the vulnerability.

The vulnerability is also documented in the vulnerability database at SecurityTracker (ID 1034410†). The entry VDB-79783 is related to this item. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

  • J8692A HP 3500-24G-PoE yl Switch
  • J8693A HP 3500-48G-PoE yl Switch
  • J8697A HP E5406 zl Switch Chassis
  • J8698A HP E5412 zl Switch Chassis
  • J8699A HP 5406-48G zl Switch
  • J8700A HP 5412-96G zl Switch
  • J8715A ProCurve Switch 8212zl Base System
  • J8715B HP E8212 zl Switch Base System
  • J8992A HP 6200-24G-mGBIC yl Switch
  • J9091A ProCurve Switch 8212zl Chassis and Fan Tray
  • J9263A HP E6600-24G Switch
  • J9264A HP 6600-24G-4XG Switch
  • J9265A HP 6600-24XG Switch
  • J9310A HP 3500-24G-PoE+ yl Switch
  • J9311A HP 3500-48G-PoE+ yl Switch
  • J9447A HP 5406-44G-PoE+-4SFP zl Switch
  • J9448A HP 5412-92G-PoE+-4SFP zl Switch
  • J9451A HP E6600-48G Switch
  • J9452A HP 6600-48G-4XG Switch
  • J9470A HP 3500-24 Switch
  • J9471A HP 3500-24-PoE Switch
  • J9472A HP 3500-48 Switch
  • J9473A HP 3500-48-PoE Switch
  • J9475A HP E8206 zl Switch Base System
  • J9532A HP 5412-92G-PoE+-2XG v2 zl Swch w Pm SW
  • J9533A HP 5406-44G-PoE+-2XG v2 zl Swch w Pm SW
  • J9539A HP 5406-44G-PoE+-4G v2 zl Swch w Prm SW
  • J9540A HP 5412-92G-PoE+-4G v2 zl Swch w Prm SW
  • J9573A HP 3800-24G-PoE+-2SFP+ Switch
  • J9574A HP 3800-48G-PoE+-4SFP+ Switch
  • J9575A HP 3800-24G-2SFP+ Switch
  • J9576A HP 3800-48G-4SFP+ Switch
  • J9584A HP 3800-24SFP-2SFP+ Switch
  • J9585A HP 3800-24G-2XG Switch
  • J9586A HP 3800-48G-4XG Switch
  • J9587A HP 3800-24G-PoE+-2XG Switch
  • J9588A HP 3800-48G-PoE+-4XG Switch
  • J9638A HP 8206-44G-PoE+-2XG v2 zl Swch w Pm SW
  • J9639A HP 8212-92G-PoE+-2XG v2 zl Swch w Pm SW
  • J9640A HP 8206 zl Switch w/Premium Software
  • J9641A HP 8212 zl Switch with Premium SW
  • J9642A HP 5406 zl Switch with Premium Software
  • J9643A HP 5412 zl Switch with Premium Software
  • J9821A HP 5406R zl2 Switch
  • J9822A HP 5412R zl2 Switch
  • J9823A HP 5406R-Gig-T-PoE+/SFP+ v2 zl2 Swch
  • J9824A HP 5406R-Gig-T-PoE+/SFP v2 zl2 Swch
  • J9825A HP 5412R-Gig-T-PoE+/SFP+ v2 zl2 Swch
  • J9826A HP 5412R-Gig-T-PoE+/SFP v2 zl2 Swch
  • J9850A HP 5406R zl2 Switch
  • J9851A HP 5412R zl2 Switch
  • J9866A HP 5406 8p10GT 8p10GE Swch and Psw
  • J9868A HP 5406R-8XGT/8SFP+ v2 zl2 Swch

Productinfo

Vendor

Name

Version

License

Website

CPE 2.3info

CPE 2.2info

CVSSv4info

VulDB Vector: 🔍
VulDB Reliability: 🔍

CVSSv3info

VulDB Meta Base Score: 8.4
VulDB Meta Temp Score: 8.2

VulDB Base Score: 8.4
VulDB Temp Score: 8.0
VulDB Vector: 🔍
VulDB Reliability: 🔍

NVD Base Score: 8.4
NVD Vector: 🔍

CVSSv2info

AVACAuCIA
💳💳💳💳💳💳
💳💳💳💳💳💳
💳💳💳💳💳💳
VectorComplexityAuthenticationConfidentialityIntegrityAvailability
UnlockUnlockUnlockUnlockUnlockUnlock
UnlockUnlockUnlockUnlockUnlockUnlock
UnlockUnlockUnlockUnlockUnlockUnlock

VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍

NVD Base Score: 🔍

Exploitinginfo

Class: Access control
CWE: CWE-264
CAPEC: 🔍
ATT&CK: 🔍

Physical: Partially
Local: Yes
Remote: No

Availability: 🔍
Status: Not defined

EPSS Score: 🔍
EPSS Percentile: 🔍

Price Prediction: 🔍
Current Price Estimation: 🔍

0-DayUnlockUnlockUnlockUnlock
TodayUnlockUnlockUnlockUnlock

Threat Intelligenceinfo

Interest: 🔍
Active Actors: 🔍
Active APT Groups: 🔍

Countermeasuresinfo

Recommended: Patch
Status: 🔍

Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍

Upgrade: Network Switch 15.18.0007

Timelineinfo

09/10/2015 🔍
12/11/2015 +92 days 🔍
12/11/2015 +0 days 🔍
12/14/2015 +3 days 🔍
12/15/2015 +1 days 🔍
01/05/2016 +21 days 🔍
07/01/2022 +2369 days 🔍

Sourcesinfo

Vendor: hp.com

Advisory: c04920918
Status: Confirmed
Confirmation: 🔍

CVE: CVE-2015-6860 (🔍)
GCVE (CVE): GCVE-0-2015-6860
GCVE (VulDB): GCVE-100-79784
SecurityTracker: 1034410

See also: 🔍

Entryinfo

Created: 12/15/2015 09:28
Updated: 07/01/2022 07:35
Changes: 12/15/2015 09:28 (50), 05/05/2018 18:02 (8), 07/01/2022 07:35 (12)
Complete: 🔍
Cache ID: 216::103

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion

No comments yet. Languages: en.

Please log in to comment.

◂ PreviousOverviewNext ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!