Hpe Nonstop Middleware
Monthly
Insecure deserialization of untrusted data in HPE NonStop Middleware (CWE-502), combined with weak handling of secret keys, allows an attacker who already holds high privileges on the middleware to submit crafted serialized content and achieve high impact to integrity and availability, with the effect capable of crossing into other security scopes (CVSS 7.9, S:C). The attack is network-reachable but sharply constrained: it requires high privileges (PR:H) and high attack complexity (AC:H), meaning the attacker must defeat the secret-key protection or hit a narrow configuration/state rather than walk a default path, and no user interaction is needed (UI:N). The realistic attacker population is therefore insiders or actors who have already compromised privileged NonStop credentials; no public exploit identified at time of analysis.
Insecure deserialization of untrusted data in HPE NonStop Middleware (CWE-502), combined with weak handling of secret keys, allows an attacker who already holds high privileges on the middleware to submit crafted serialized content and achieve high impact to integrity and availability, with the effect capable of crossing into other security scopes (CVSS 7.9, S:C). The attack is network-reachable but sharply constrained: it requires high privileges (PR:H) and high attack complexity (AC:H), meaning the attacker must defeat the secret-key protection or hit a narrow configuration/state rather than walk a default path, and no user interaction is needed (UI:N). The realistic attacker population is therefore insiders or actors who have already compromised privileged NonStop credentials; no public exploit identified at time of analysis.