CVE-2016-4385
Severity CVSS v4.0:
Pending analysis
Type:
CWE-502
Deserialization of Untrusted Dat
Publication date:
29/09/2016
Last modified:
12/04/2025
Description
The RMI service in HP Network Automation Software 9.1x, 9.2x, 10.0x before 10.00.02.01, and 10.1x before 10.11.00.01 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) and Commons BeanUtils libraries.
Impact
Base Score 3.x
7.30
Severity 3.x
HIGH
Base Score 2.0
7.50
Severity 2.0
HIGH
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:hp:network_automation:9.10:*:*:*:*:*:*:* | ||
| cpe:2.3:a:hp:network_automation:9.20:*:*:*:*:*:*:* | ||
| cpe:2.3:a:hp:network_automation:9.22:*:*:*:*:*:*:* | ||
| cpe:2.3:a:hp:network_automation:9.22.01:*:*:*:*:*:*:* | ||
| cpe:2.3:a:hp:network_automation:9.22.02:*:*:*:*:*:*:* | ||
| cpe:2.3:a:hp:network_automation:10.00:*:*:*:*:*:*:* | ||
| cpe:2.3:a:hp:network_automation:10.00.01:*:*:*:*:*:*:* | ||
| cpe:2.3:a:hp:network_automation:10.00.02:*:*:*:*:*:*:* | ||
| cpe:2.3:a:hp:network_automation:10.10:*:*:*:*:*:*:* | ||
| cpe:2.3:a:hp:network_automation:10.11:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- http://www.securityfocus.com/bid/93109
- http://www.zerodayinitiative.com/advisories/ZDI-16-523/
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05279098
- https://www.tenable.com/security/research/tra-2016-27
- http://www.securityfocus.com/bid/93109
- http://www.zerodayinitiative.com/advisories/ZDI-16-523/
- https://h20566.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c05279098
- https://www.tenable.com/security/research/tra-2016-27



