Permissions, Privileges, and Access Controls in IBM Hardware Management Console - CVE-2022-43926
Published: October 16, 2023
Vulnerability identifier: #VU82014
CSH Severity: Low
CVSS v4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-43926
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an attacker with physical access to escalate privileges on the system.
The vulnerability exists due to application does not properly impose security restrictions. An attacker with physical access can trigger the vulnerability to elevate privileges to root on the underneath HMC linux system without having HMC credentials.
Affected software
IBM Hardware Management Console
IBM Power Hardware Management Console (HMC)
IBM Power Hardware Management Console (HMC)
How to mitigate CVE-2022-43926
Install updates from vendor's website.
IBM Power Hardware Management Console (HMC) - addressed in versions 9.2.950.0 SP3, 10.1.1020.0 SP1, 10.2.1030.0, 10.2.1030.0 SP1