Vulnerability record · CVE-2012-4361 · published 20 August 2012
CVE-2012-4361: HP SAN/iQ ping utility OS command injection
Hp · San\/Iq
The ping handler in lhn/public/network/ping on HP SAN/iQ before 9.5 fails to neutralize shell metacharacters in its second parameter, allowing OS command injection. An attacker with valid credentials can run arbitrary commands on the HP Virtual SAN Appliance, which is a storage management component.
Description
lhn/public/network/ping in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to execute arbitrary commands via shell metacharacters in the second parameter.
AV:A/AC:L/Au:S/C:C/I:C/A:C
Automated analysis
high priorityAuthenticated remote command execution with public exploits and very high EPSS, though exploitation requires prior credentials and adjacent network access.
What it is
The ping handler in lhn/public/network/ping on HP SAN/iQ before 9.5 fails to neutralize shell metacharacters in its second parameter, allowing OS command injection. An attacker with valid credentials can run arbitrary commands on the HP Virtual SAN Appliance, which is a storage management component.
Impact
An authenticated attacker gains arbitrary command execution on the appliance, leading to full compromise of confidentiality, integrity and availability of the device and the data it manages.
Attack surface
Reached over the adjacent network via the ping network interface; the CVSS vector (AV:A/Au:S) indicates the attacker must already hold valid credentials and be on the same network segment. No user interaction is required.
Exploitation
Public exploit code exists (Exploit-DB 18893 and 18901), and EPSS is 0.478 (98.8th percentile), but the CVE is not listed in CISA KEV and no ransomware use is documented.
What to do
- Upgrade HP SAN/iQ to version 9.5 or later, which fixes the command injection.
- If upgrade is not possible, restrict network access to the ping interface to trusted management hosts only.
- Enforce least privilege and strong unique credentials for appliance accounts to limit who can reach the vulnerable endpoint.
- Monitor and audit use of the ping function and alert on unexpected shell metacharacters in its parameters.
Detection
- Inspect appliance and web logs for requests to lhn/public/network/ping containing shell metacharacters (;, |, &, $, backticks).
- Alert on unexpected child processes or command execution spawned by the ping handler.
- Monitor for outbound connections or file changes on the SAN/iQ appliance that do not match normal management activity.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| http://www.exploit-db.com/exploits/18893/ | Exploit |
| http://www.exploit-db.com/exploits/18901/ | Exploit |
| http://www.kb.cert.org/vuls/id/441363 | US Government Resource |
| http://www.exploit-db.com/exploits/18893/ | Exploit |
| http://www.exploit-db.com/exploits/18901/ | Exploit |
| http://www.kb.cert.org/vuls/id/441363 | US Government Resource |
Track CVE-2012-4361 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2012-4361), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
