Three vulnerabilities in the HP Device Manager could be exploited by attackers to take over Windows systems. These three critical and high severity vulnerabilities, tracked as CVE-2020-6925, CVE-2020-6926, and CVE-2020-6927, that impact the HP Device Manager could be chained together to achieve SYSTEM privileges on targeted devices and potentially take over them. The HP Device Manager allows administrators to remotely manage HP thin clients. These vulnerabilities may allow locally managed accounts within HP Device Manager to be susceptible to dictionary attacks due to weak cipher implementation (CVE-2020-6925) and allow a malicious actor to remotely gain unauthorized access to resources (CVE-2020-6926), and/or allow a malicious actor to gain SYSTEM privileges (CVE-2020-6927). CVE-2020-6925 does not impact customers who are using Active Directory authenticated accounts. CVE-2020-6927 does not impact customers who are using an external database (Microsoft SQL Server) and have not installed the integrated Postgres service.
CVE-2020-6925 – Weak Cipher
CVE-2020-6926 – Remote Method Invocation
CVE-2020-6927 – Elevation of Privilege
In the interim, customers can partially mitigate this issue in any of the following ways:
Updates will be available at https://support.hp.com/us-en/document/c06921908 as soon as released by the vendor.