Autopass License Server CVE-2024-51770

The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N vector indicates a high-risk vulnerability: Network-accessible (AV:N) with low attack complexity (AC:L), requiring no privileges or user interaction, with high confidentiality impact. The absence of integrity or availability impact suggests this is purely an information disclosure issue. While the CVSS base score of 7.5 is high, the lack of integrity impact means attackers cannot modify or delete data—only exfiltrate it. In SSVC terms, this represents an exploitable information disclosure affecting confidential license data, potentially including serial numbers, activation codes, or system configuration details. Without confirmation of KEV status, POC availability, or EPSS score, organizations should treat this as a moderate-to-high priority issue based on the easy exploitability (no authentication required) and sensitivity of license management data, particularly in regulated industries. The network accessibility and simplicity of exploitation suggest real attackers are likely to discover and exploit this vulnerability.

An attacker performs reconnaissance and discovers an internet-accessible HPE AutoPass License Server instance, either directly or through network scanning. Since the vulnerability requires no authentication (PR:N) or user interaction (UI:N) and has low attack complexity (AC:L), the attacker can craft a simple HTTP request or exploit an unauthenticated API endpoint to extract sensitive information. Potential data of interest includes: active license serial numbers, customer information, activation codes, system configuration, or deployment details. The attacker exfiltrates this information without triggering integrity or availability alarms, potentially using the license data for license bypass attempts, selling data to competitors, or leveraging system information for further targeted attacks. The attack leaves minimal forensic evidence since no modifications were made to the system, potentially allowing undetected data compromise for extended periods.