CVE-2024-13980

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2024-13980", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2025-08-25T18:56:50.272Z", "datePublished": "2025-08-27T21:25:05.918Z", "dateUpdated": "2026-05-15T11:14:30.684Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "modules": ["/byod/index.xhtml"], "product": "Intelligent Management Center (iMC)", "vendor": "H3C Group", "versions": [{"lessThanOrEqual": "E0632H07", "status": "affected", "version": "0", "versionType": "custom"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:hp:intelligent_management_center:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndIncluding": "E0632H07"}]}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "H3C Intelligent Management Center (IMC) versions up to and including E0632H07 contains a remote command execution vulnerability in the /byod/index.xhtml endpoint. Improper handling of JSF ViewState allows unauthenticated attackers to craft POST requests with forged javax.faces.ViewState parameters, potentially leading to arbitrary command execution. This flaw does not require authentication and may be exploited without session cookies. An affected version range is undefined.&nbsp;Exploitation evidence was first observed by the Shadowserver Foundation on <span style=\"background-color: rgb(255, 255, 255);\">2024-08-28 UTC</span>."}], "value": "H3C Intelligent Management Center (IMC) versions up to and including E0632H07 contains a remote command execution vulnerability in the /byod/index.xhtml endpoint. Improper handling of JSF ViewState allows unauthenticated attackers to craft POST requests with forged javax.faces.ViewState parameters, potentially leading to arbitrary command execution. This flaw does not require authentication and may be exploited without session cookies. An affected version range is undefined.\u00a0Exploitation evidence was first observed by the Shadowserver Foundation on 2024-08-28 UTC."}], "impacts": [{"capecId": "CAPEC-137", "descriptions": [{"lang": "en", "value": "CAPEC-137 Parameter Injection"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 10, "baseSeverity": "CRITICAL", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-05-15T11:14:30.684Z"}, "references": [{"tags": ["exploit"], "url": "https://blog.csdn.net/nnn2188185/article/details/141065540"}, {"tags": ["technical-description", "exploit"], "url": "https://github.com/OJZen/FckESC/blob/master/%E5%86%85%E7%BD%91%E7%99%BB%E5%BD%95%E8%BF%87%E7%A8%8B.txt"}, {"tags": ["technical-description", "exploit"], "url": "https://blog.csdn.net/weixin_48539059/article/details/141033966"}, {"tags": ["technical-description", "exploit"], "url": "https://axsec.blog.csdn.net/article/details/141003376"}, {"tags": ["product"], "url": "https://www.h3c.com/cn/Service/Online_Help/psirt/"}, {"tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/h3c-intelligent-management-center-rce"}], "source": {"discovery": "UNKNOWN"}, "tags": ["x_known-exploited-vulnerability"], "title": "H3C Intelligent Management Center (iMC) /byod/index.xhtml RCE", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-28T13:51:33.102773Z", "id": "CVE-2024-13980", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-28T13:51:50.554Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-13980", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-08-28T13:51:33.102773Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-28T13:51:45.439Z"}}], "cna": {"tags": ["x_known-exploited-vulnerability"], "title": "H3C Intelligent Management Center (iMC) /byod/index.xhtml RCE", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-137", "descriptions": [{"lang": "en", "value": "CAPEC-137 Parameter Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 10, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "H3C Group", "modules": ["/byod/index.xhtml"], "product": "Intelligent Management Center (iMC)", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "E0632H07"}], "defaultStatus": "unknown"}], "references": [{"url": "https://blog.csdn.net/nnn2188185/article/details/141065540", "tags": ["exploit"]}, {"url": "https://github.com/OJZen/FckESC/blob/master/%E5%86%85%E7%BD%91%E7%99%BB%E5%BD%95%E8%BF%87%E7%A8%8B.txt", "tags": ["technical-description", "exploit"]}, {"url": "https://blog.csdn.net/weixin_48539059/article/details/141033966", "tags": ["technical-description", "exploit"]}, {"url": "https://axsec.blog.csdn.net/article/details/141003376", "tags": ["technical-description", "exploit"]}, {"url": "https://www.h3c.com/cn/Service/Online_Help/psirt/", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/h3c-intelligent-management-center-rce", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "H3C Intelligent Management Center (IMC) versions up to and including E0632H07 contains a remote command execution vulnerability in the /byod/index.xhtml endpoint. Improper handling of JSF ViewState allows unauthenticated attackers to craft POST requests with forged javax.faces.ViewState parameters, potentially leading to arbitrary command execution. This flaw does not require authentication and may be exploited without session cookies. An affected version range is undefined.\u00a0Exploitation evidence was first observed by the Shadowserver Foundation on 2024-08-28 UTC.", "supportingMedia": [{"type": "text/html", "value": "H3C Intelligent Management Center (IMC) versions up to and including E0632H07 contains a remote command execution vulnerability in the /byod/index.xhtml endpoint. Improper handling of JSF ViewState allows unauthenticated attackers to craft POST requests with forged javax.faces.ViewState parameters, potentially leading to arbitrary command execution. This flaw does not require authentication and may be exploited without session cookies. An affected version range is undefined.&nbsp;Exploitation evidence was first observed by the Shadowserver Foundation on <span style=\"background-color: rgb(255, 255, 255);\">2024-08-28 UTC</span>.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-502", "description": "CWE-502 Deserialization of Untrusted Data"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:hp:intelligent_management_center:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "E0632H07", "versionStartIncluding": "0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-05-15T11:14:30.684Z"}}}, "cveMetadata": {"cveId": "CVE-2024-13980", "state": "PUBLISHED", "dateUpdated": "2026-05-15T11:14:30.684Z", "dateReserved": "2025-08-25T18:56:50.272Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2025-08-27T21:25:05.918Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "modules": ["/byod/index.xhtml"], "product": "Intelligent Management Center (iMC)", "vendor": "H3C Group", "versions": [{"lessThanOrEqual": "E0632H07", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "H3C Intelligent Management Center (IMC) versions up to and including E0632H07 contains a remote command execution vulnerability in the /byod/index.xhtml endpoint. Improper handling of JSF ViewState allows unauthenticated attackers to craft POST requests with forged javax.faces.ViewState parameters, potentially leading to arbitrary command execution. This flaw does not require authentication and may be exploited without session cookies. An affected version range is undefined.\u00a0Exploitation evidence was first observed by the Shadowserver Foundation on 2024-08-28 UTC."}, {"lang": "es", "value": "Las versiones de H3C Intelligent Management Center (IMC) hasta e incluyendo E0632H07 contienen una vulnerabilidad de ejecuci\u00f3n remota de comandos en el endpoint /byod/index.xhtml. El manejo inadecuado de JSF ViewState permite a atacantes no autenticados crear solicitudes POST con par\u00e1metros javax.faces.ViewState falsificados, lo que podr\u00eda llevar a la ejecuci\u00f3n arbitraria de comandos. Esta falla no requiere autenticaci\u00f3n y puede ser explotada sin cookies de sesi\u00f3n. Un rango de versiones afectadas no est\u00e1 definido. La evidencia de explotaci\u00f3n fue observada por primera vez por la Shadowserver Foundation el 28-08-2024 UTC."}], "id": "CVE-2024-13980", "lastModified": "2026-09-26T21:10:00.130", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-13980", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-08-28T13:51:33.102773Z", "version": "2.0.3"}}]}, "published": "2025-08-27T22:15:33.250", "references": [{"source": "disclosure@vulncheck.com", "url": "https://axsec.blog.csdn.net/article/details/141003376"}, {"source": "disclosure@vulncheck.com", "url": "https://blog.csdn.net/nnn2188185/article/details/141065540"}, {"source": "disclosure@vulncheck.com", "url": "https://blog.csdn.net/weixin_48539059/article/details/141033966"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/OJZen/FckESC/blob/master/%E5%86%85%E7%BD%91%E7%99%BB%E5%BD%95%E8%BF%87%E7%A8%8B.txt"}, {"source": "disclosure@vulncheck.com", "url": "https://www.h3c.com/cn/Service/Online_Help/psirt/"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/h3c-intelligent-management-center-rce"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-502"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{}