Vulnerability in HP Universal Internet Of Things
CVE-2019-11990
Security vulnerabilities in HPE UIoT versions 1.6, 1.5, 1.4.2, 1.4.1, 1.4.0, and 1.2.4.2 could allow unauthorized remote access and access to sensitive data. HPE has addressed this issue in HPE UIoT: * For customers with release UIoT 1.6, fixes are made available with 1.6 RP603 * For customers with release UIoT 1.5, fixes are made available with 1.5 RP503 HF3 * For customers with release older than 1.5, such as 1.4.0, 1.4.1, 1.4.2 and 1.2.4.2, the resolution will be to upgrade to 1.5 RP503 HF3 or 1.6 RP603 Customers are requested to upgrade to the updated versions or contact HPE support for further assistance.
EPSS: 0.016 (72.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Hp Universal_internet_of_things — versions 1.2.4.2, 1.4.0, 1.4.1
- N/a Hpe Iot And Gcp — versions 1.6, 1.5, 1.4.0, 1,4,1, 1.4.2, 1.2.4.2
References
- security-alert@hpe.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-11990?
- CVE-2019-11990 is a high-severity vulnerability in HP Universal Internet Of Things. CVSS score: 8.8/10. Published 2019-07-19.
- How severe is CVE-2019-11990?
- High severity. CVSS v3 base score is 8.8 out of 10.