CVE-2012-4361
HP SAN/iQ < 9.5 - Authenticated OS Command Injection via Ping Parameter
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2012-4361.
PoCs published by Metasploit, Nicolas Gregoire, Nicolas Gregoire, sinn3r, including Metasploit module exploits/multi/misc/hp_vsa_exec.
AI-analyzed exploit summary This Metasploit module exploits a command injection vulnerability in HP StorageWorks P4000 Virtual SAN Appliance by leveraging default credentials to inject arbitrary commands via a crafted ping request on port 13838.
Description
lhn/public/network/ping in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to execute arbitrary commands via shell metacharacters in the second parameter.
Exploits (3)
This Metasploit module exploits a command injection vulnerability in HP StorageWorks P4000 Virtual SAN Appliance by leveraging default credentials to inject arbitrary commands via a crafted ping request on port 13838.
This exploit targets a command injection vulnerability in HP VSA/SANiQ Hydra client (CVE-2012-4362). It sends a crafted packet to execute arbitrary commands via a backdoor login and a command injection in the ping functionality, resulting in a reverse shell.
This Metasploit module exploits a command injection vulnerability in HP StorageWorks P4000 Virtual SAN Appliance by leveraging default credentials to inject arbitrary commands via a crafted ping request on port 13838.