3 HP Device Manager vulnerabilities could let attackers access systems remotely

In September 2020, HP announced that its HP Device Manager app had three serious security vulnerabilities. Exploited together, they allowed an attacker to take control of the server the app was running on, with the highest privileges in Windows. The news is a few years old, but its lessons still apply today to any app used to manage computers.

HP Device Manager is a program HP created so that system administrators can centrally manage HP Thin Client computers from a server.

What are the three vulnerabilities?

The three vulnerabilities were recorded in the official references as CVE-2020-6925, CVE-2020-6926 and CVE-2020-6927. They were discovered by security researcher Nicky Bloor.

• CVE-2020-6925 – a weak encryption implementation that allowed attackers to crack local users’ passwords through dictionary attacks.
• CVE-2020-6926 – a vulnerability in the remote communication component (Remote Method Invocation) that let attackers access the system remotely, without authentication. It received a severity score of 9.9 out of 10.
• CVE-2020-6927 – allowed attackers to gain the highest privileges on the server through a hidden account in the built-in PostgreSQL database. The account, called “dm_postgres”, had full rights over the database, and its password was a single space.

Can we protect ourselves from these vulnerabilities?

Yes. At the time of the announcement, there was no update that fixed all three problems. HP Device Manager 5.0.4 fixed the CVE-2020-6927 vulnerability, and for the other two, HP published protective measures, summarized by Tenable:

• access to ports 1099 and 40002 on the server is allowed only from trusted computers or only locally;
• the PostgreSQL database port (40006) is restricted to local access only, in the Windows firewall;
• the password of the “dm_postgres” account is changed, or the account is deleted.

Companies that used an external Microsoft SQL Server database, without the built-in PostgreSQL service, weren’t affected by CVE-2020-6927.

If you still use HP Device Manager, install the latest available version and check HP’s security bulletin to make sure the problems are fixed for your version. You’ll find more about the discovery in the article The Register published at the time.

Even so, a serious security policy greatly reduces the risk. A well-configured firewall, a centrally managed security solution and a segmented network make it much harder for attackers to reach these systems remotely.

What lessons still apply to companies today?

Computer management apps are among attackers’ favorite targets, because they have rights over every computer they manage: whoever controls the console controls them all. In July 2021, for example, the REvil attackers used the Kaseya VSA management app to spread down the chain to customers’ companies. Details in the article on ransomware as a service (RaaS).

A few simple rules:

• Keep a record of the management apps in your company: the consoles for computers, printers, cameras, the network and backup. A forgotten one no longer gets updated.
• Don’t expose management consoles to the internet. Access goes through the internal network or through a VPN with two-step verification.
• Change default passwords and check the documentation for the service accounts the app creates during installation.
• Follow manufacturers’ security bulletins and install critical updates quickly. The catalog of actively exploited vulnerabilities (Known Exploited Vulnerabilities) kept by CISA, the US cybersecurity agency, shows what needs to be updated first.
• Keep a backup of your management servers, separate from the network, so you can rebuild them if they’re compromised.

This kind of information is very useful for system administrators, because they can take steps to protect the infrastructures they look after.

RezolvIT is a managed IT services company in Bucharest, ISO/IEC 27001 certified, that takes security very seriously. We handle IT maintenance, including system updates, IT security and Backup as a Service, for companies of any size, from a few computers to subsidiaries of multinationals. We start with a free IT audit.