Platform
Managed Security Services
Managed Penetration Testing
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Resources
September 22, 2023
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]September 22, 2023Severity Medium Analysis Summary First discovered in 2016, Revenge RAT is a remote access trojan (RAT) designed to give an attacker complete control over an infected […]September 22, 2023Severity High Analysis Summary The Konni APT (Advanced Persistent Threat) group is a cyber espionage group that has been active since at least 2014. It is […]Threat Insights
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Connect with Us
Platform
Managed Security Services
Managed Penetration Testing
Rewterz penetration testing services help organizations determine if a cyber attacker can gain access to their critical assets while giving them detailed insights of the overall business impact of a cyber attack.
Resources
September 22, 2023Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]September 22, 2023Severity Medium Analysis Summary First discovered in 2016, Revenge RAT is a remote access trojan (RAT) designed to give an attacker complete control over an infected […]September 22, 2023Severity High Analysis Summary The Konni APT (Advanced Persistent Threat) group is a cyber espionage group that has been active since at least 2014. It is […]Threat Insights
Before Rewterz got its start, the market was in dire need of a specialized and dedicated information security company. It was nearly impossible for businesses to find a trustworthy provider that could truly cover all of their bases. We wanted to meet this need, giving companies across the globe a chance to get ahead while knowing that their data is in good hands.
Connect with Us
Rewterz Threat Alert – Latest Trickbot IOCs
October 5, 2020Rewterz Threat Advisory – CVE-2020-25776 – Trend Micro Antivirus for Mac privilege escalation
October 5, 2020
Severity
High
Analysis Summary
Three vulnerabilities in the HP Device Manager could be exploited by attackers to take over Windows systems. These three critical and high severity vulnerabilities, tracked as CVE-2020-6925, CVE-2020-6926, and CVE-2020-6927, that impact the HP Device Manager could be chained together to achieve SYSTEM privileges on targeted devices and potentially take over them. The HP Device Manager allows administrators to remotely manage HP thin clients. These vulnerabilities may allow locally managed accounts within HP Device Manager to be susceptible to dictionary attacks due to weak cipher implementation (CVE-2020-6925) and allow a malicious actor to remotely gain unauthorized access to resources (CVE-2020-6926), and/or allow a malicious actor to gain SYSTEM privileges (CVE-2020-6927). CVE-2020-6925 does not impact customers who are using Active Directory authenticated accounts. CVE-2020-6927 does not impact customers who are using an external database (Microsoft SQL Server) and have not installed the integrated Postgres service.
CVE-2020-6925 – Weak Cipher
CVE-2020-6926 – Remote Method Invocation
CVE-2020-6927 – Elevation of Privilege
Impact
- Unauthorized Remote Access
- Privilege Escalation
- Systems Takeover
Affected Vendors
HP
Affected Products
- All versions of HP Device Manager
- HP Device Manager 5.0.0
- HP Device Manager 5.0.1
- HP Device Manager 5.0.2
- HP Device Manager 5.0.3
Remediation
- Update is available for HP Device Manager 5.0: Update to HP Device Manager 5.0.4
- For HP Device Manager 4.7, Update is yet to be released: HP Device Manager 4.7 Service Pack 13
In the interim, customers can partially mitigate this issue in any of the following ways:
- Limit incoming access to Device Manager ports 1099 and 40002 to trusted IPs or localhost only.
- Remove the dm_postgres account from the Postgres database; or
- Update the dm_postgres account password within HP Device Manager Configuration Manager; or
- Within Windows Firewall configuration create an inbound rule to configure the PostgreSQL listening port (40006) for localhost access only.
Updates will be available at https://support.hp.com/us-en/document/c06921908 as soon as released by the vendor.