Search
Find a vulnerability
Search criteria
2 vulnerabilities by Hp
GCVE-1988-2026-0184
Vulnerability from gna-1988 – Published: 2026-09-08 07:25 – Updated: 2026-09-09 13:04
VLAI
EPSS
VEX
Title
HP Easy Start for macOS: CVE-2026-12554 / CVE-2026-12555 / CVE-2026-12556
Summary
Hello Full Disclosure list,
Cipher Security Labs has published technical details for three
High-severity vulnerabilities affecting HP Easy Start for macOS. The
issues were coordinated with HP and are addressed in HP Easy Start
2.16.7.260722 and later under HPSBPI04124.
Research title:
Rooted in Trust: Breaking HP Easy Start’s macOS Privilege Boundaries
Affected product:
HP Easy Start for macOS
Affected versions:
Versions prior to 2.16.7.260722
Validated vulnerable sample:
2.16.0 (build 251010)
Fixed:
2.16.7.260722 and later
CVE-2026-12554
CVSS 4.0: 8.5 High
CWE-1104: Use of Unmaintained Third-Party Components
The affected software-download path contained an OSPFTP stack wired
into component acquisition, including fallback URL-scheme handling.
The research does not claim that every installation uses FTP on the
normal path; the finding is that an unmaintained FTP-capable component
remained active on the privileged software-delivery surface.
CVE-2026-12555
CVSS 4.0: 7.7 High
CWE-379: Creation of Temporary File in Directory with Insecure Permissions
The HP Uninstaller used predictable paths under /tmp and /private/tmp
while operating with administrative privileges. An unprivileged local
user could prepare a symbolic link before the elevated process opened
the path. In our PoC, after the user approved the normal macOS
administrative prompt, HP-generated log data was appended through the
symlink to an attacker-selected proof file as root.
We intentionally describe this as privileged file
modification/corruption rather than unrestricted arbitrary file write:
destination control is demonstrated, but the log content itself is
generated by HP Easy Start. Follow-on privilege escalation would
require a suitable environment-specific target and is not automatic.
CVE-2026-12556
CVSS 4.0: 7.7 High
CWE-319: Cleartext Transmission of Sensitive Information
HP Easy Start 2.16.0 set NSAllowsArbitraryLoads=true in its App
Transport Security policy and retained cleartext FTP as a
software-download fallback. Together these conditions expanded the
circumstances in which a network-positioned attacker could interfere
with software-component acquisition when the primary scheme failed.
The research does not claim that NSAllowsArbitraryLoads alone disables
certificate validation, that every install falls back to FTP, or that
package substitution automatically yields code execution. Those are
separate conditions and are treated separately in the analysis.
Related design note — not a fourth CVE
The 2.16.0 build also contained SWHelper, a privileged helper using
Apple’s deprecated AuthorizationExecuteWithPrivileges API. The legacy
API and path-oriented privileged install flow were confirmed, but an
end-to-end package-swap TOCTOU against the production staging path was
not demonstrated. This is therefore documented only as a risky
privilege-boundary design with conditional exploitability.
Remediation validation
In 2.16.7 (build 260722), Cipher Security Labs validated that:
• the vulnerable Uninstaller bundle was removed from the package tested;
• OSPFTP download classes and FTP software-download markers were absent;
• blanket ATS relaxation was tightened;
• SWHelper and AuthorizationExecuteWithPrivileges were removed;
• a new privileged helper used SMAppService and NSXPCConnection;
• the helper restricted clients by code-signing identity; and
• package SHA-256 was verified using an already-open file descriptor
before invoking /usr/sbin/installer.
Research:
https://ciphersecuritylabs.com/papers/rooted-in-trust-breaking-hp-easy-starts-macos-privilege-boundaries
HP advisory:
https://support.hp.com/us-en/document/ish_15512340-15512362-16/hpsbpi04124
CVE records:
https://www.cve.org/CVERecord?id=CVE-2026-12554
https://www.cve.org/CVERecord?id=CVE-2026-12555
https://www.cve.org/CVERecord?id=CVE-2026-12556
Researcher:
Nir Yehoshua
Cipher Security Labs
nir () ciphersecuritylabs com
https://ciphersecuritylabs.com
Regards,
Nir
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Hp | HP Easy Start |
Affected:
unknown
|
Relationships
reference
GCVE-1988-2026-0184 (this record)
- related CVE-2026-12554
- related CVE-2026-12555
- related CVE-2026-12556
{
"containers": {
"cna": {
"affected": [
{
"product": "HP Easy Start",
"vendor": "Hp",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nir Yehoshua"
}
],
"descriptions": [
{
"lang": "en",
"value": "Hello Full Disclosure list,\n\nCipher Security Labs has published technical details for three\nHigh-severity vulnerabilities affecting HP Easy Start for macOS. The\nissues were coordinated with HP and are addressed in HP Easy Start\n2.16.7.260722 and later under HPSBPI04124.\n\nResearch title:\nRooted in Trust: Breaking HP Easy Start\u2019s macOS Privilege Boundaries\n\nAffected product:\nHP Easy Start for macOS\n\nAffected versions:\nVersions prior to 2.16.7.260722\n\nValidated vulnerable sample:\n2.16.0 (build 251010)\n\nFixed:\n2.16.7.260722 and later\n\nCVE-2026-12554\nCVSS 4.0: 8.5 High\nCWE-1104: Use of Unmaintained Third-Party Components\n\nThe affected software-download path contained an OSPFTP stack wired\ninto component acquisition, including fallback URL-scheme handling.\nThe research does not claim that every installation uses FTP on the\nnormal path; the finding is that an unmaintained FTP-capable component\nremained active on the privileged software-delivery surface.\n\nCVE-2026-12555\nCVSS 4.0: 7.7 High\nCWE-379: Creation of Temporary File in Directory with Insecure Permissions\n\nThe HP Uninstaller used predictable paths under /tmp and /private/tmp\nwhile operating with administrative privileges. An unprivileged local\nuser could prepare a symbolic link before the elevated process opened\nthe path. In our PoC, after the user approved the normal macOS\nadministrative prompt, HP-generated log data was appended through the\nsymlink to an attacker-selected proof file as root.\n\nWe intentionally describe this as privileged file\nmodification/corruption rather than unrestricted arbitrary file write:\ndestination control is demonstrated, but the log content itself is\ngenerated by HP Easy Start. Follow-on privilege escalation would\nrequire a suitable environment-specific target and is not automatic.\n\nCVE-2026-12556\nCVSS 4.0: 7.7 High\nCWE-319: Cleartext Transmission of Sensitive Information\n\nHP Easy Start 2.16.0 set NSAllowsArbitraryLoads=true in its App\nTransport Security policy and retained cleartext FTP as a\nsoftware-download fallback. Together these conditions expanded the\ncircumstances in which a network-positioned attacker could interfere\nwith software-component acquisition when the primary scheme failed.\n\nThe research does not claim that NSAllowsArbitraryLoads alone disables\ncertificate validation, that every install falls back to FTP, or that\npackage substitution automatically yields code execution. Those are\nseparate conditions and are treated separately in the analysis.\n\nRelated design note \u2014 not a fourth CVE\n\nThe 2.16.0 build also contained SWHelper, a privileged helper using\nApple\u2019s deprecated AuthorizationExecuteWithPrivileges API. The legacy\nAPI and path-oriented privileged install flow were confirmed, but an\nend-to-end package-swap TOCTOU against the production staging path was\nnot demonstrated. This is therefore documented only as a risky\nprivilege-boundary design with conditional exploitability.\n\nRemediation validation\n\nIn 2.16.7 (build 260722), Cipher Security Labs validated that:\n\n\u2022 the vulnerable Uninstaller bundle was removed from the package tested;\n\u2022 OSPFTP download classes and FTP software-download markers were absent;\n\u2022 blanket ATS relaxation was tightened;\n\u2022 SWHelper and AuthorizationExecuteWithPrivileges were removed;\n\u2022 a new privileged helper used SMAppService and NSXPCConnection;\n\u2022 the helper restricted clients by code-signing identity; and\n\u2022 package SHA-256 was verified using an already-open file descriptor\nbefore invoking /usr/sbin/installer.\n\nResearch:\nhttps://ciphersecuritylabs.com/papers/rooted-in-trust-breaking-hp-easy-starts-macos-privilege-boundaries\n\nHP advisory:\nhttps://support.hp.com/us-en/document/ish_15512340-15512362-16/hpsbpi04124\n\nCVE records:\nhttps://www.cve.org/CVERecord?id=CVE-2026-12554\nhttps://www.cve.org/CVERecord?id=CVE-2026-12555\nhttps://www.cve.org/CVERecord?id=CVE-2026-12556\n\nResearcher:\nNir Yehoshua\nCipher Security Labs\nnir () ciphersecuritylabs com\nhttps://ciphersecuritylabs.com\n\nRegards,\nNir\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1104",
"description": "CWE-1104",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-319",
"description": "CWE-319",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-379",
"description": "CWE-379",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:04:24Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/30"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/30"
},
{
"url": "https://ciphersecuritylabs.com"
},
{
"url": "https://ciphersecuritylabs.com/papers/rooted-in-trust-breaking-hp-easy-starts-macos-privilege-boundaries"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.hp.com/us-en/document/ish_15512340-15512362-16/hpsbpi04124"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12554"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12555"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12556"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/30"
],
"discovery": "EXTERNAL"
},
"title": "HP Easy Start for macOS: CVE-2026-12554 / CVE-2026-12555 / CVE-2026-12556",
"x_gcve": [
{
"recordType": "reference",
"relationships": [
{
"destId": "CVE-2026-12554",
"type": "related"
},
{
"destId": "CVE-2026-12555",
"type": "related"
},
{
"destId": "CVE-2026-12556",
"type": "related"
}
],
"vulnId": "GCVE-1988-2026-0184",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/30",
"automated": true,
"contentSha256": "61c9431dd26b12d0e0e725b221865d75fb5f48e06993b913e6bb067fb60517f3",
"evidenceScore": 8,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/30",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-09-02T20:13:24Z"
}
},
{
"recordType": "advisory",
"vulnId": "gcve-1988-2026-0184"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-08T07:25:42Z",
"dateUpdated": "2026-09-09T13:04:24Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0184"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
GCVE-1988-2026-0001
Vulnerability from gna-1988 – Published: 2026-09-07 06:41 – Updated: 2026-09-09 13:04
VLAI
EPSS
VEX
Title
HP Easy Start for macOS: CVE-2026-12554 / CVE-2026-12555 / CVE-2026-12556
Summary
Hello Full Disclosure list,
Cipher Security Labs has published technical details for three
High-severity vulnerabilities affecting HP Easy Start for macOS. The
issues were coordinated with HP and are addressed in HP Easy Start
2.16.7.260722 and later under HPSBPI04124.
Research title:
Rooted in Trust: Breaking HP Easy Start’s macOS Privilege Boundaries
Affected product:
HP Easy Start for macOS
Affected versions:
Versions prior to 2.16.7.260722
Validated vulnerable sample:
2.16.0 (build 251010)
Fixed:
2.16.7.260722 and later
CVE-2026-12554
CVSS 4.0: 8.5 High
CWE-1104: Use of Unmaintained Third-Party Components
The affected software-download path contained an OSPFTP stack wired
into component acquisition, including fallback URL-scheme handling.
The research does not claim that every installation uses FTP on the
normal path; the finding is that an unmaintained FTP-capable component
remained active on the privileged software-delivery surface.
CVE-2026-12555
CVSS 4.0: 7.7 High
CWE-379: Creation of Temporary File in Directory with Insecure Permissions
The HP Uninstaller used predictable paths under /tmp and /private/tmp
while operating with administrative privileges. An unprivileged local
user could prepare a symbolic link before the elevated process opened
the path. In our PoC, after the user approved the normal macOS
administrative prompt, HP-generated log data was appended through the
symlink to an attacker-selected proof file as root.
We intentionally describe this as privileged file
modification/corruption rather than unrestricted arbitrary file write:
destination control is demonstrated, but the log content itself is
generated by HP Easy Start. Follow-on privilege escalation would
require a suitable environment-specific target and is not automatic.
CVE-2026-12556
CVSS 4.0: 7.7 High
CWE-319: Cleartext Transmission of Sensitive Information
HP Easy Start 2.16.0 set NSAllowsArbitraryLoads=true in its App
Transport Security policy and retained cleartext FTP as a
software-download fallback. Together these conditions expanded the
circumstances in which a network-positioned attacker could interfere
with software-component acquisition when the primary scheme failed.
The research does not claim that NSAllowsArbitraryLoads alone disables
certificate validation, that every install falls back to FTP, or that
package substitution automatically yields code execution. Those are
separate conditions and are treated separately in the analysis.
Related design note — not a fourth CVE
The 2.16.0 build also contained SWHelper, a privileged helper using
Apple’s deprecated AuthorizationExecuteWithPrivileges API. The legacy
API and path-oriented privileged install flow were confirmed, but an
end-to-end package-swap TOCTOU against the production staging path was
not demonstrated. This is therefore documented only as a risky
privilege-boundary design with conditional exploitability.
Remediation validation
In 2.16.7 (build 260722), Cipher Security Labs validated that:
• the vulnerable Uninstaller bundle was removed from the package tested;
• OSPFTP download classes and FTP software-download markers were absent;
• blanket ATS relaxation was tightened;
• SWHelper and AuthorizationExecuteWithPrivileges were removed;
• a new privileged helper used SMAppService and NSXPCConnection;
• the helper restricted clients by code-signing identity; and
• package SHA-256 was verified using an already-open file descriptor
before invoking /usr/sbin/installer.
Research:
https://ciphersecuritylabs.com/papers/rooted-in-trust-breaking-hp-easy-starts-macos-privilege-boundaries
HP advisory:
https://support.hp.com/us-en/document/ish_15512340-15512362-16/hpsbpi04124
CVE records:
https://www.cve.org/CVERecord?id=CVE-2026-12554
https://www.cve.org/CVERecord?id=CVE-2026-12555
https://www.cve.org/CVERecord?id=CVE-2026-12556
Researcher:
Nir Yehoshua
Cipher Security Labs
nir () ciphersecuritylabs com
https://ciphersecuritylabs.com
Regards,
Nir
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/
Severity
No CVSS data available.
Assigner
References
10 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Hp | HP Easy Start |
Affected:
unknown
|
{
"containers": {
"cna": {
"affected": [
{
"product": "HP Easy Start",
"vendor": "Hp",
"versions": [
{
"status": "affected",
"version": "unknown"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nir Yehoshua"
}
],
"descriptions": [
{
"lang": "en",
"value": "Hello Full Disclosure list,\n\nCipher Security Labs has published technical details for three\nHigh-severity vulnerabilities affecting HP Easy Start for macOS. The\nissues were coordinated with HP and are addressed in HP Easy Start\n2.16.7.260722 and later under HPSBPI04124.\n\nResearch title:\nRooted in Trust: Breaking HP Easy Start\u2019s macOS Privilege Boundaries\n\nAffected product:\nHP Easy Start for macOS\n\nAffected versions:\nVersions prior to 2.16.7.260722\n\nValidated vulnerable sample:\n2.16.0 (build 251010)\n\nFixed:\n2.16.7.260722 and later\n\nCVE-2026-12554\nCVSS 4.0: 8.5 High\nCWE-1104: Use of Unmaintained Third-Party Components\n\nThe affected software-download path contained an OSPFTP stack wired\ninto component acquisition, including fallback URL-scheme handling.\nThe research does not claim that every installation uses FTP on the\nnormal path; the finding is that an unmaintained FTP-capable component\nremained active on the privileged software-delivery surface.\n\nCVE-2026-12555\nCVSS 4.0: 7.7 High\nCWE-379: Creation of Temporary File in Directory with Insecure Permissions\n\nThe HP Uninstaller used predictable paths under /tmp and /private/tmp\nwhile operating with administrative privileges. An unprivileged local\nuser could prepare a symbolic link before the elevated process opened\nthe path. In our PoC, after the user approved the normal macOS\nadministrative prompt, HP-generated log data was appended through the\nsymlink to an attacker-selected proof file as root.\n\nWe intentionally describe this as privileged file\nmodification/corruption rather than unrestricted arbitrary file write:\ndestination control is demonstrated, but the log content itself is\ngenerated by HP Easy Start. Follow-on privilege escalation would\nrequire a suitable environment-specific target and is not automatic.\n\nCVE-2026-12556\nCVSS 4.0: 7.7 High\nCWE-319: Cleartext Transmission of Sensitive Information\n\nHP Easy Start 2.16.0 set NSAllowsArbitraryLoads=true in its App\nTransport Security policy and retained cleartext FTP as a\nsoftware-download fallback. Together these conditions expanded the\ncircumstances in which a network-positioned attacker could interfere\nwith software-component acquisition when the primary scheme failed.\n\nThe research does not claim that NSAllowsArbitraryLoads alone disables\ncertificate validation, that every install falls back to FTP, or that\npackage substitution automatically yields code execution. Those are\nseparate conditions and are treated separately in the analysis.\n\nRelated design note \u2014 not a fourth CVE\n\nThe 2.16.0 build also contained SWHelper, a privileged helper using\nApple\u2019s deprecated AuthorizationExecuteWithPrivileges API. The legacy\nAPI and path-oriented privileged install flow were confirmed, but an\nend-to-end package-swap TOCTOU against the production staging path was\nnot demonstrated. This is therefore documented only as a risky\nprivilege-boundary design with conditional exploitability.\n\nRemediation validation\n\nIn 2.16.7 (build 260722), Cipher Security Labs validated that:\n\n\u2022 the vulnerable Uninstaller bundle was removed from the package tested;\n\u2022 OSPFTP download classes and FTP software-download markers were absent;\n\u2022 blanket ATS relaxation was tightened;\n\u2022 SWHelper and AuthorizationExecuteWithPrivileges were removed;\n\u2022 a new privileged helper used SMAppService and NSXPCConnection;\n\u2022 the helper restricted clients by code-signing identity; and\n\u2022 package SHA-256 was verified using an already-open file descriptor\nbefore invoking /usr/sbin/installer.\n\nResearch:\nhttps://ciphersecuritylabs.com/papers/rooted-in-trust-breaking-hp-easy-starts-macos-privilege-boundaries\n\nHP advisory:\nhttps://support.hp.com/us-en/document/ish_15512340-15512362-16/hpsbpi04124\n\nCVE records:\nhttps://www.cve.org/CVERecord?id=CVE-2026-12554\nhttps://www.cve.org/CVERecord?id=CVE-2026-12555\nhttps://www.cve.org/CVERecord?id=CVE-2026-12556\n\nResearcher:\nNir Yehoshua\nCipher Security Labs\nnir () ciphersecuritylabs com\nhttps://ciphersecuritylabs.com\n\nRegards,\nNir\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1104",
"description": "CWE-1104",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-319",
"description": "CWE-319",
"lang": "en",
"type": "CWE"
},
{
"cweId": "CWE-379",
"description": "CWE-379",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-09T13:04:24Z",
"orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"shortName": "VULNARCHIVE"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/30"
},
{
"tags": [
"technical-description"
],
"url": "https://seclists.org/fulldisclosure/2026/Sep/30"
},
{
"url": "https://ciphersecuritylabs.com"
},
{
"url": "https://ciphersecuritylabs.com/papers/rooted-in-trust-breaking-hp-easy-starts-macos-privilege-boundaries"
},
{
"url": "https://nmap.org/mailman/listinfo/fulldisclosure"
},
{
"url": "https://seclists.org/fulldisclosure/"
},
{
"url": "https://support.hp.com/us-en/document/ish_15512340-15512362-16/hpsbpi04124"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12554"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12555"
},
{
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12556"
}
],
"source": {
"defect": [
"https://seclists.org/fulldisclosure/2026/Sep/30"
],
"discovery": "EXTERNAL"
},
"title": "HP Easy Start for macOS: CVE-2026-12554 / CVE-2026-12555 / CVE-2026-12556",
"x_gcve": [
{
"recordType": "advisory",
"relationships": [],
"vulnId": "GCVE-1988-2026-0001",
"x_vulnarchive": {
"archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/30",
"automated": true,
"contentSha256": "61c9431dd26b12d0e0e725b221865d75fb5f48e06993b913e6bb067fb60517f3",
"evidenceScore": 8,
"messageId": "",
"originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/30",
"policy": "vulnarchive-1",
"sourceFormat": "text/html",
"sourcePublishedAt": "2026-09-02T20:13:24Z"
}
}
]
}
},
"cveMetadata": {
"assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
"assignerShortName": "VULNARCHIVE",
"datePublished": "2026-09-07T06:41:22Z",
"dateUpdated": "2026-09-09T13:04:24Z",
"state": "PUBLISHED",
"vulnId": "GCVE-1988-2026-0001"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}