Rewterz Threat Alert – HP Device Manager Flaws Expose Windows Systems to Hack

Severity

High

Analysis Summary

Three vulnerabilities in the HP Device Manager could be exploited by attackers to take over Windows systems. These three critical and high severity vulnerabilities, tracked as CVE-2020-6925, CVE-2020-6926, and CVE-2020-6927, that impact the HP Device Manager could be chained together to achieve SYSTEM privileges on targeted devices and potentially take over them. The HP Device Manager allows administrators to remotely manage HP thin clients. These vulnerabilities may allow locally managed accounts within HP Device Manager to be susceptible to dictionary attacks due to weak cipher implementation (CVE-2020-6925) and allow a malicious actor to remotely gain unauthorized access to resources (CVE-2020-6926), and/or allow a malicious actor to gain SYSTEM privileges (CVE-2020-6927). CVE-2020-6925 does not impact customers who are using Active Directory authenticated accounts. CVE-2020-6927 does not impact customers who are using an external database (Microsoft SQL Server) and have not installed the integrated Postgres service.

CVE-2020-6925 – Weak Cipher

CVE-2020-6926 – Remote Method Invocation

CVE-2020-6927 – Elevation of Privilege

Impact

• Unauthorized Remote Access
• Privilege Escalation
• Systems Takeover

Affected Vendors

HP

Affected Products

• All versions of HP Device Manager
• HP Device Manager 5.0.0
• HP Device Manager 5.0.1
• HP Device Manager 5.0.2
• HP Device Manager 5.0.3

Remediation

• Update is available for HP Device Manager 5.0: Update to HP Device Manager 5.0.4
• For HP Device Manager 4.7, Update is yet to be released: HP Device Manager 4.7 Service Pack 13

In the interim, customers can partially mitigate this issue in any of the following ways:

• Limit incoming access to Device Manager ports 1099 and 40002 to trusted IPs or localhost only.
• Remove the dm_postgres account from the Postgres database; or
• Update the dm_postgres account password within HP Device Manager Configuration Manager; or
• Within Windows Firewall configuration create an inbound rule to configure the PostgreSQL listening port (40006) for localhost access only.

Updates will be available at https://support.hp.com/us-en/document/c06921908 as soon as released by the vendor.