CVE-2019-5392

MEDIUM

HPE Intelligent Management Center < 7.3 E0506P09 - Information Disclosure

Title source: exploit-db.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2019-5392 has a selected CVSS score of 5.3 (medium); EIP currently links 1 catalogued exploit and 1 repository PoC.

Description

A disclosure of information vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1
Repository PoCs
1

Affected products and versions

1
ProductSourceVersion range

HPE Intelligent Management Center (IMC) PLAT

CVE List7.3 E0506P09 and earlieraffected

Proofs of concept

2

Catalogued exploits

ExploitDBHPE Intelligent Management Center < 7.3 E0506P09 - Information DisclosureExploitDB exploitby Lazy HackerNot analyzed1 file
ExploitDB
PoC details

Repository PoCs

GitHubjozliner/CVE-2019-5392-for-Python3Repository PoCby jozliner0Scanner2 files

2.3 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python 3 script that connects to a target, sends a crafted ASN.1 BER-encoded request to list a directory, and prints the response. It does not execute a payload or gain code execution; it only retrieves and displays directory contents, which aligns with the CVE-2019-5392 information disclosure vulnerability.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a Python script (CVE-2019-5392.py) and a README.md file. The script implements a proof-of-concept for CVE-2019-5392, an information disclosure vulnerability in HPE Intelligent Management Center. It connects to a target IP and port, sends a crafted ASN.1 BER-encoded payload requesting directory contents, receives the response, and prints a cleaned version of the data. No backdoor, deceptive payload, persistence, credential theft, or unrelated remote access behavior is observed. The script performs only the advertised exploit functionality.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesPython
Target softwareHPE Intelligent Management Center (IMC) PLAT
Attack typesinformation disclosure
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The script sends a request and prints the response, which is a directory listing. It does not contain any code to execute commands, drop files, or establish a shell. This is consistent with a scanner that validates the information disclosure vulnerability rather than an exploit that achieves code execution or further compromise.

CVE-2019-5392.py:1-90

Requirements

  • Target must be running vulnerable HPE IMC PLAT service on the specified port (default 2810).CVE-2019-5392.py:17
  • Network connectivity to the target IP and port is required.CVE-2019-5392.py:23-31

Observed behavior

  • Accepts target IP, port, and directory path as command-line arguments.CVE-2019-5392.py:12-18
  • Constructs an ASN.1 BER-encoded message containing a flag and the requested directory path.CVE-2019-5392.py:34-45
  • Sends the encoded message to the target and receives a response.CVE-2019-5392.py:59-62
  • Decodes and prints the received data, which is expected to be a directory listing.CVE-2019-5392.py:68-87
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Network Connection
Payload withheldThe script connects to a target specified by the user to send the exploit payload and receive the response, consistent with the stated CVE-2019-5392 PoC.CVE-2019-5392.py:23-31
Payload Construction
Payload withheldThe script constructs a payload matching the expected format for the CVE-2019-5392 vulnerability, using the pyasn1 library.CVE-2019-5392.py:34-51
Data Exfiltration
Payload withheldThe script receives up to 4000 bytes from the target, decodes it, applies regex-based cleaning, and prints the result. This is the intended information disclosure of the PoC.CVE-2019-5392.py:61-87
Review boundaries

What the analysis did not establish

  • Only the Python script and README were provided; no network traffic or execution output is available to confirm the actual behavior.
  • The script's effectiveness depends on the target service's response format, which is not verified here.
  • Only the two text files (CVE-2019-5392.py and README.md) from the repository snapshot are included in the evidence. No other files, dependencies, or commit history were reviewed.
  • The analysis is static; the script was not executed, and its runtime behavior cannot be confirmed.
  • The evidence does not include the pyasn1 library or other imported modules, which could theoretically introduce backdoor behavior, but no evidence of such is present in the reviewed code.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

3