Hpe Nonstop Tcp Ip Utilities
Monthly
Unauthenticated remote attackers can cause a denial of service in the finger daemon of HPE NonStop TCP/IP UTILITIES (version T8602L01^BAA and earlier) by sending crafted requests to the network-reachable finger service. The flaw stems from missing authentication (CWE-306) in the daemon, allowing any remote user to disrupt availability without credentials. No public exploit code has been identified at time of analysis, but the service is legacy and often disabled or firewalled, limiting exposure.
Denial of service in HPE NonStop TCP/IP Utilities (T8602L01^BAA and earlier) can be triggered when the traceroute utility is executed under specific, non-default conditions, allowing a remote attacker to render the affected utility unavailable. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H, score 5.3) confirms the attacker needs no authentication and can act remotely, but exploitation depends on a narrow precondition (high attack complexity) and on a traceroute invocation or operator action occurring (required user interaction), so the attacker cannot trigger the condition unilaterally. Impact is restricted to availability - there is no confidentiality or integrity loss and no code execution - and no public exploit has been identified at time of analysis.
Unauthenticated remote attackers can cause a denial of service in the finger daemon of HPE NonStop TCP/IP UTILITIES (version T8602L01^BAA and earlier) by sending crafted requests to the network-reachable finger service. The flaw stems from missing authentication (CWE-306) in the daemon, allowing any remote user to disrupt availability without credentials. No public exploit code has been identified at time of analysis, but the service is legacy and often disabled or firewalled, limiting exposure.
Denial of service in HPE NonStop TCP/IP Utilities (T8602L01^BAA and earlier) can be triggered when the traceroute utility is executed under specific, non-default conditions, allowing a remote attacker to render the affected utility unavailable. The assessed CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H, score 5.3) confirms the attacker needs no authentication and can act remotely, but exploitation depends on a narrow precondition (high attack complexity) and on a traceroute invocation or operator action occurring (required user interaction), so the attacker cannot trigger the condition unilaterally. Impact is restricted to availability - there is no confidentiality or integrity loss and no code execution - and no public exploit has been identified at time of analysis.