VAR-201609-0439
Vulnerability from variot - Updated: 2025-04-13 23:17The RMI service in HP Network Automation Software 9.1x, 9.2x, 10.0x before 10.00.02.01, and 10.1x before 10.11.00.01 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) and Commons BeanUtils libraries. Supplementary information : CWE Vulnerability type by CWE-502: Deserialization of Untrusted Data ( Deserialization of unreliable data ) Has been identified. http://cwe.mitre.org/data/definitions/502.htmlSkillfully crafted serialized by a third party Java An arbitrary command may be executed through the object. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Network Automation. Authentication is not required to exploit this vulnerability.The specific flaw exists within an exposed RMI registry on TCP port 6099. An attacker can leverage this vulnerability to execute arbitrary code under the context of the process. HP Network Automation automates the entire operational lifecycle of network devices, from configuration to policy-based change management, compliance, and security management. HP Network Automation versions 9.1x, 9.2x, 10.0x, 10.1x are affected
Show details on source website{
"affected_products": {
"_id": null,
"data": [
{
"_id": null,
"model": "network automation",
"scope": "eq",
"trust": 2.5,
"vendor": "hp",
"version": "9.10"
},
{
"_id": null,
"model": "network automation",
"scope": "eq",
"trust": 2.5,
"vendor": "hp",
"version": "9.20"
},
{
"_id": null,
"model": "network automation",
"scope": "eq",
"trust": 2.5,
"vendor": "hp",
"version": "9.22"
},
{
"_id": null,
"model": "network automation",
"scope": "eq",
"trust": 1.6,
"vendor": "hp",
"version": "10.00"
},
{
"_id": null,
"model": "network automation",
"scope": "eq",
"trust": 1.6,
"vendor": "hp",
"version": "10.10"
},
{
"_id": null,
"model": "network automation",
"scope": "eq",
"trust": 1.6,
"vendor": "hp",
"version": "10.00.01"
},
{
"_id": null,
"model": "network automation",
"scope": "eq",
"trust": 1.6,
"vendor": "hp",
"version": "9.22.02"
},
{
"_id": null,
"model": "network automation",
"scope": "eq",
"trust": 1.6,
"vendor": "hp",
"version": "9.22.01"
},
{
"_id": null,
"model": "network automation",
"scope": "eq",
"trust": 1.6,
"vendor": "hp",
"version": "10.00.02"
},
{
"_id": null,
"model": "network automation",
"scope": "eq",
"trust": 1.6,
"vendor": "hp",
"version": "10.11"
},
{
"_id": null,
"model": "network automation",
"scope": "eq",
"trust": 0.9,
"vendor": "hp",
"version": "9.10.2"
},
{
"_id": null,
"model": "network automation",
"scope": "eq",
"trust": 0.9,
"vendor": "hp",
"version": "9.2"
},
{
"_id": null,
"model": "network automation",
"scope": "eq",
"trust": 0.9,
"vendor": "hp",
"version": "10.1"
},
{
"_id": null,
"model": "network automation",
"scope": "eq",
"trust": 0.9,
"vendor": "hp",
"version": "10.0"
},
{
"_id": null,
"model": "hp network automation",
"scope": "lt",
"trust": 0.8,
"vendor": "hewlett packard",
"version": "10.0x"
},
{
"_id": null,
"model": "hp network automation",
"scope": "lt",
"trust": 0.8,
"vendor": "hewlett packard",
"version": "10.1x"
},
{
"_id": null,
"model": "hp network automation",
"scope": "eq",
"trust": 0.8,
"vendor": "hewlett packard",
"version": "9.2x"
},
{
"_id": null,
"model": "hp network automation",
"scope": "eq",
"trust": 0.8,
"vendor": "hewlett packard",
"version": "10.00.02.01"
},
{
"_id": null,
"model": "hp network automation",
"scope": "eq",
"trust": 0.8,
"vendor": "hewlett packard",
"version": "9.1x"
},
{
"_id": null,
"model": "hp network automation",
"scope": "eq",
"trust": 0.8,
"vendor": "hewlett packard",
"version": "10.11.00.01"
},
{
"_id": null,
"model": "network automation",
"scope": null,
"trust": 0.7,
"vendor": "hewlett packard",
"version": null
},
{
"_id": null,
"model": "network automation",
"scope": "ne",
"trust": 0.3,
"vendor": "hp",
"version": "10.20"
},
{
"_id": null,
"model": "network automation",
"scope": "ne",
"trust": 0.3,
"vendor": "hp",
"version": "10.11"
},
{
"_id": null,
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "network automation",
"version": "9.10"
},
{
"_id": null,
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "network automation",
"version": "9.20"
},
{
"_id": null,
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "network automation",
"version": "9.22"
},
{
"_id": null,
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "network automation",
"version": "9.22.01"
},
{
"_id": null,
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "network automation",
"version": "9.22.02"
},
{
"_id": null,
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "network automation",
"version": "10.00"
},
{
"_id": null,
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "network automation",
"version": "10.00.01"
},
{
"_id": null,
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "network automation",
"version": "10.00.02"
},
{
"_id": null,
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "network automation",
"version": "10.10"
},
{
"_id": null,
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "network automation",
"version": "10.11"
}
],
"sources": [
{
"db": "IVD",
"id": "1bb1d221-024b-4b31-b820-29a903286677"
},
{
"db": "ZDI",
"id": "ZDI-16-523"
},
{
"db": "CNVD",
"id": "CNVD-2016-08069"
},
{
"db": "BID",
"id": "93109"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-005047"
},
{
"db": "CNNVD",
"id": "CNNVD-201609-576"
},
{
"db": "NVD",
"id": "CVE-2016-4385"
}
]
},
"configurations": {
"_id": null,
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:hp:network_automation",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-005047"
}
]
},
"credits": {
"_id": null,
"data": "Jacob Baines - Tenable Network Security",
"sources": [
{
"db": "ZDI",
"id": "ZDI-16-523"
},
{
"db": "BID",
"id": "93109"
},
{
"db": "CNNVD",
"id": "CNNVD-201609-576"
}
],
"trust": 1.6
},
"cve": "CVE-2016-4385",
"cvss": {
"_id": null,
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2016-4385",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 2.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2016-08069",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "1bb1d221-024b-4b31-b820-29a903286677",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.2,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"exploitabilityScore": 3.9,
"id": "CVE-2016-4385",
"impactScore": 3.4,
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2016-4385",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2016-4385",
"trust": 0.8,
"value": "High"
},
{
"author": "ZDI",
"id": "CVE-2016-4385",
"trust": 0.7,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2016-08069",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201609-576",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "1bb1d221-024b-4b31-b820-29a903286677",
"trust": 0.2,
"value": "HIGH"
},
{
"author": "VULMON",
"id": "CVE-2016-4385",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "1bb1d221-024b-4b31-b820-29a903286677"
},
{
"db": "ZDI",
"id": "ZDI-16-523"
},
{
"db": "CNVD",
"id": "CNVD-2016-08069"
},
{
"db": "VULMON",
"id": "CVE-2016-4385"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-005047"
},
{
"db": "CNNVD",
"id": "CNNVD-201609-576"
},
{
"db": "NVD",
"id": "CVE-2016-4385"
}
]
},
"description": {
"_id": null,
"data": "The RMI service in HP Network Automation Software 9.1x, 9.2x, 10.0x before 10.00.02.01, and 10.1x before 10.11.00.01 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) and Commons BeanUtils libraries. Supplementary information : CWE Vulnerability type by CWE-502: Deserialization of Untrusted Data ( Deserialization of unreliable data ) Has been identified. http://cwe.mitre.org/data/definitions/502.htmlSkillfully crafted serialized by a third party Java An arbitrary command may be executed through the object. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Hewlett Packard Enterprise Network Automation. Authentication is not required to exploit this vulnerability.The specific flaw exists within an exposed RMI registry on TCP port 6099. An attacker can leverage this vulnerability to execute arbitrary code under the context of the process. HP Network Automation automates the entire operational lifecycle of network devices, from configuration to policy-based change management, compliance, and security management. \nHP Network Automation versions 9.1x, 9.2x, 10.0x, 10.1x are affected",
"sources": [
{
"db": "NVD",
"id": "CVE-2016-4385"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-005047"
},
{
"db": "ZDI",
"id": "ZDI-16-523"
},
{
"db": "CNVD",
"id": "CNVD-2016-08069"
},
{
"db": "BID",
"id": "93109"
},
{
"db": "IVD",
"id": "1bb1d221-024b-4b31-b820-29a903286677"
},
{
"db": "VULMON",
"id": "CVE-2016-4385"
}
],
"trust": 3.33
},
"external_ids": {
"_id": null,
"data": [
{
"db": "NVD",
"id": "CVE-2016-4385",
"trust": 4.3
},
{
"db": "BID",
"id": "93109",
"trust": 2.6
},
{
"db": "ZDI",
"id": "ZDI-16-523",
"trust": 2.1
},
{
"db": "TENABLE",
"id": "TRA-2016-27",
"trust": 1.1
},
{
"db": "CNVD",
"id": "CNVD-2016-08069",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201609-576",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2016-005047",
"trust": 0.8
},
{
"db": "ZDI_CAN",
"id": "ZDI-CAN-3728",
"trust": 0.7
},
{
"db": "IVD",
"id": "1BB1D221-024B-4B31-B820-29A903286677",
"trust": 0.2
},
{
"db": "VULMON",
"id": "CVE-2016-4385",
"trust": 0.1
}
],
"sources": [
{
"db": "IVD",
"id": "1bb1d221-024b-4b31-b820-29a903286677"
},
{
"db": "ZDI",
"id": "ZDI-16-523"
},
{
"db": "CNVD",
"id": "CNVD-2016-08069"
},
{
"db": "VULMON",
"id": "CVE-2016-4385"
},
{
"db": "BID",
"id": "93109"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-005047"
},
{
"db": "CNNVD",
"id": "CNNVD-201609-576"
},
{
"db": "NVD",
"id": "CVE-2016-4385"
}
]
},
"id": "VAR-201609-0439",
"iot": {
"_id": null,
"data": true,
"sources": [
{
"db": "IVD",
"id": "1bb1d221-024b-4b31-b820-29a903286677"
},
{
"db": "CNVD",
"id": "CNVD-2016-08069"
}
],
"trust": 1.3608828000000002
},
"iot_taxonomy": {
"_id": null,
"data": [
{
"category": [
"IoT",
"ICS"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "1bb1d221-024b-4b31-b820-29a903286677"
},
{
"db": "CNVD",
"id": "CNVD-2016-08069"
}
]
},
"last_update_date": "2025-04-13T23:17:51.895000Z",
"patch": {
"_id": null,
"data": [
{
"title": "HPSBGN03649",
"trust": 0.8,
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05279098"
},
{
"title": "Hewlett Packard Enterprise has issued an update to correct this vulnerability.",
"trust": 0.7,
"url": "https://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05279098"
},
{
"title": "Patch for HP Network Automation Java Deserialization Remote Code Execution Vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/81675"
},
{
"title": "HPE Network Automation Apache Commons-Collections and Commons-BeanUtils Fixes for library remote code execution vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=64297"
},
{
"title": "Java-Deserialization-Cheat-Sheet",
"trust": 0.1,
"url": "https://github.com/klausware/Java-Deserialization-Cheat-Sheet "
},
{
"title": "Java-Deserialization-Cheat-Sheet",
"trust": 0.1,
"url": "https://github.com/GrrrDog/Java-Deserialization-Cheat-Sheet "
},
{
"title": "Java-Deserialization-CVEs",
"trust": 0.1,
"url": "https://github.com/PalindromeLabs/Java-Deserialization-CVEs "
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-16-523"
},
{
"db": "CNVD",
"id": "CNVD-2016-08069"
},
{
"db": "VULMON",
"id": "CVE-2016-4385"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-005047"
},
{
"db": "CNNVD",
"id": "CNNVD-201609-576"
}
]
},
"problemtype_data": {
"_id": null,
"data": [
{
"problemtype": "CWE-502",
"trust": 1.0
},
{
"problemtype": "CWE-Other",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2016-005047"
},
{
"db": "NVD",
"id": "CVE-2016-4385"
}
]
},
"references": {
"_id": null,
"data": [
{
"trust": 2.3,
"url": "http://www.securityfocus.com/bid/93109"
},
{
"trust": 1.4,
"url": "http://www.zerodayinitiative.com/advisories/zdi-16-523/"
},
{
"trust": 1.1,
"url": "https://h20566.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c05279098"
},
{
"trust": 1.1,
"url": "https://www.tenable.com/security/research/tra-2016-27"
},
{
"trust": 1.0,
"url": "https://h20564.www2.hpe.com/hpsc/doc/public/display?docid=emr_na-c05279098"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-4385"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2016-4385"
},
{
"trust": 0.6,
"url": "https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docdisplay?docid=emr_na-c05279098"
},
{
"trust": 0.3,
"url": "http://www.hp.com/"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/502.html"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/viewalert.x?alertid=48999"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://github.com/grrrdog/java-deserialization-cheat-sheet"
}
],
"sources": [
{
"db": "ZDI",
"id": "ZDI-16-523"
},
{
"db": "CNVD",
"id": "CNVD-2016-08069"
},
{
"db": "VULMON",
"id": "CVE-2016-4385"
},
{
"db": "BID",
"id": "93109"
},
{
"db": "JVNDB",
"id": "JVNDB-2016-005047"
},
{
"db": "CNNVD",
"id": "CNNVD-201609-576"
},
{
"db": "NVD",
"id": "CVE-2016-4385"
}
]
},
"sources": {
"_id": null,
"data": [
{
"db": "IVD",
"id": "1bb1d221-024b-4b31-b820-29a903286677",
"ident": null
},
{
"db": "ZDI",
"id": "ZDI-16-523",
"ident": null
},
{
"db": "CNVD",
"id": "CNVD-2016-08069",
"ident": null
},
{
"db": "VULMON",
"id": "CVE-2016-4385",
"ident": null
},
{
"db": "BID",
"id": "93109",
"ident": null
},
{
"db": "JVNDB",
"id": "JVNDB-2016-005047",
"ident": null
},
{
"db": "CNNVD",
"id": "CNNVD-201609-576",
"ident": null
},
{
"db": "NVD",
"id": "CVE-2016-4385",
"ident": null
}
]
},
"sources_release_date": {
"_id": null,
"data": [
{
"date": "2016-09-26T00:00:00",
"db": "IVD",
"id": "1bb1d221-024b-4b31-b820-29a903286677",
"ident": null
},
{
"date": "2016-09-21T00:00:00",
"db": "ZDI",
"id": "ZDI-16-523",
"ident": null
},
{
"date": "2016-09-26T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-08069",
"ident": null
},
{
"date": "2016-09-29T00:00:00",
"db": "VULMON",
"id": "CVE-2016-4385",
"ident": null
},
{
"date": "2016-09-21T00:00:00",
"db": "BID",
"id": "93109",
"ident": null
},
{
"date": "2016-10-04T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-005047",
"ident": null
},
{
"date": "2016-09-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201609-576",
"ident": null
},
{
"date": "2016-09-29T14:59:00.177000",
"db": "NVD",
"id": "CVE-2016-4385",
"ident": null
}
]
},
"sources_update_date": {
"_id": null,
"data": [
{
"date": "2016-09-21T00:00:00",
"db": "ZDI",
"id": "ZDI-16-523",
"ident": null
},
{
"date": "2016-09-26T00:00:00",
"db": "CNVD",
"id": "CNVD-2016-08069",
"ident": null
},
{
"date": "2018-02-17T00:00:00",
"db": "VULMON",
"id": "CVE-2016-4385",
"ident": null
},
{
"date": "2016-09-23T00:01:00",
"db": "BID",
"id": "93109",
"ident": null
},
{
"date": "2016-12-05T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2016-005047",
"ident": null
},
{
"date": "2016-09-30T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201609-576",
"ident": null
},
{
"date": "2025-04-12T10:46:40.837000",
"db": "NVD",
"id": "CVE-2016-4385",
"ident": null
}
]
},
"threat_type": {
"_id": null,
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201609-576"
}
],
"trust": 0.6
},
"title": {
"_id": null,
"data": "HP Network Automation Java Deserialization Remote code execution vulnerability",
"sources": [
{
"db": "IVD",
"id": "1bb1d221-024b-4b31-b820-29a903286677"
},
{
"db": "CNVD",
"id": "CNVD-2016-08069"
}
],
"trust": 0.8
},
"type": {
"_id": null,
"data": "other",
"sources": [
{
"db": "IVD",
"id": "1bb1d221-024b-4b31-b820-29a903286677"
},
{
"db": "CNNVD",
"id": "CNNVD-201609-576"
}
],
"trust": 0.8
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…