HP StoreVirtual Storage Devices Vulnerability: Unauthorized Administrative Access via Unused One-Time Password

CVE-2013-2352 · HIGH Severity

AV:N/AC:L/AU:N/C:N/I:C/A:C

LeftHand OS (aka SAN iQ) 10.5 and earlier on HP StoreVirtual Storage devices does not provide a mechanism for disabling the HP Support challenge-response root-login feature, which makes it easier for remote attackers to obtain administrative access by leveraging knowledge of an unused one-time password.

Learn more about our Web Application Penetration Testing UK.