CVE-2016-4372

CRITICAL

HPE iMC PLAT <7.2 - Remote Code Execution

Title source: manual
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2016-4372. PoCs published by Raphael Kuhn.

AI-analyzed exploit summary This exploit targets a Java deserialization vulnerability in HPE/H3C IMC (Intelligent Management Center) by sending a malicious payload to the '/imc/topo/WebDMServlet' endpoint. It supports both binary payload files and string-based payloads, leveraging ysoserial for payload generation.

Description

HPE iMC PLAT before 7.2 E0403P04, iMC EAD before 7.2 E0405P05, iMC APM before 7.2 E0401P04, iMC NTA before 7.2 E0401P01, iMC BIMS before 7.2 E0402P02, and iMC UAM_TAM before 7.2 E0405P05 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

Exploits (1)

exploitdb WORKING POC
by Raphael Kuhn · pythonremotejava
https://www.exploit-db.com/exploits/42756

This exploit targets a Java deserialization vulnerability in HPE/H3C IMC (Intelligent Management Center) by sending a malicious payload to the '/imc/topo/WebDMServlet' endpoint. It supports both binary payload files and string-based payloads, leveraging ysoserial for payload generation.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: HPE/H3C IMC (Intelligent Management Center) with Java 1.8.0_91
No auth needed
Prerequisites: Access to ysoserial.jar for payload generation · Network access to the target server
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit, Third Party Advisory exploit x_refsource_exploit-db
https://www.exploit-db.com/exploits/42756/
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/91739

Scores

CVSS v3 9.8
EPSS 0.1020
EPSS Percentile 93.3%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-20
Status published
Products (6)
hp/intelligent_management_center_application_performance_manager < 7.2
hp/intelligent_management_center_branch_intelligent_management_system < 7.2
hp/intelligent_management_center_endpoint_admission_defense < 7.2
hp/intelligent_management_center_network_traffic_analyzer < 7.2
hp/intelligent_management_center_platform < 7.2
hp/intelligent_management_center_user_access_management < 7.2
Published Jul 15, 2016
Tracked Since Feb 18, 2026