CVE-2021-26575
📋 TL;DR
This CVE describes a path traversal vulnerability in HPE Apollo 70 System BMC firmware that allows attackers to delete arbitrary files on the system. Attackers with network access to the BMC can exploit this to potentially delete critical system files, leading to denial of service or system compromise. Only HPE Apollo 70 systems with BMC firmware prior to version 3.0.14.0 are affected.
💻 Affected Systems
- HPE Apollo 70 System
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical system files, rendering the server inoperable and potentially allowing privilege escalation to the host operating system.
Likely Case
Denial of service by deleting critical BMC or system files, causing server management functions to fail and potentially requiring physical intervention.
If Mitigated
Limited impact if BMC is isolated on management network with strict access controls, though file deletion could still disrupt management functions.
🎯 Exploit Status
Path traversal vulnerabilities typically have low exploitation complexity. The advisory suggests network access to BMC is sufficient for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.0.14.0 or later
Vendor Advisory: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04080en_us
Restart Required: Yes
Instructions:
1. Download firmware version 3.0.14.0 or later from HPE Support. 2. Access BMC web interface or use remote management tools. 3. Navigate to firmware update section. 4. Upload and apply the new firmware. 5. Reboot the BMC to complete installation.
🔧 Temporary Workarounds
Network Isolation
allIsolate BMC management interface to dedicated management network with strict firewall rules
Access Control
allImplement strict network access controls to BMC interface, allowing only authorized management stations
🧯 If You Can't Patch
- Isolate BMC interface on dedicated VLAN with strict firewall rules allowing only trusted management IPs
- Disable unnecessary BMC services and interfaces, monitor for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check BMC firmware version via web interface (System Information) or SSH to BMC using 'show version' commandCheck Version:
ssh admin@bmc-ip 'show version' or check web interface at https://bmc-ip/#/system/informationVerify Fix Applied:
Confirm firmware version is 3.0.14.0 or later in BMC web interface or via SSH📡 Detection & Monitoring
Log Indicators:
- Unusual file deletion events in BMC logs
- Multiple failed authentication attempts to BMC
- Unexpected connections to BMC web interface
Network Indicators:
- Unusual traffic patterns to BMC port 443/80
- Requests containing path traversal patterns (../) to BMC
SIEM Query:
source="bmc_logs" AND (event="file_deletion" OR message="*../*") OR dest_port=443 AND dest_ip="bmc_network" AND http_uri="*../*"