HPE Intelligent Management Center dbman Opcode 10008 Command Injection

Critical Nessus Plugin ID 100870


A network management system running on the remote host is affected by a command injection vulnerability.


The HPE Intelligent Management Center (iMC) PLAT running on the remote host is affected by a command injection vulnerability in the dbman service due to improper validation of user-supplied input before passing it to a system call. An unauthenticated, remote attacker can exploit this, via a specially crafted opcode 10008 request, to inject and execute arbitrary OS commands with SYSTEM or root privileges.

Note that the HP iMC dbman service running on the remote host is reportedly affected by additional vulnerabilities; however, Nessus has not tested for these.


Upgrade the HPE iMC version to 7.3 E0504P04 or later.

See Also



Plugin Details

Severity: Critical

ID: 100870

File Name: hp_imc_dbman_cve-2017-5816.nbin

Version: $Revision: 1.6 $

Type: remote

Family: Misc.

Published: 2017/06/19

Modified: 2018/01/29

Dependencies: 71885, 11936

Risk Information

Risk Factor: Critical


Base Score: 10

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C


Base Score: 9.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vulnerability Information

CPE: cpe:/a:hp:intelligent_management_center

Required KB Items: installed_sw/HP Intelligent Management Center Web Interface, Host/OS

Exploited by Nessus: true

Patch Publication Date: 2017/05/11

Vulnerability Publication Date: 2017/05/11

Reference Information

CVE: CVE-2017-5816

BID: 98469

OSVDB: 157505

HP: emr_na-hpesbhf03745en_us, HPESBHF03745

ZDI: ZDI-17-340