CVE-2017-5791: HPE Intelligent Management Center authentication bypass via crafted URI

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityUnauthenticated remote authentication bypass in a network management platform with CVSS 9.8 and very high EPSS, though no confirmed in-the-wild exploitation is recorded.

What it is

The doFilter method in UrlAccessController in HPE Intelligent Management Center (iMC) PLAT 7.2 E0403P06 fails to properly enforce authentication, allowing remote bypass using unspecified strings in a URI. Because iMC is a network management platform, an unauthenticated bypass exposes a high-value control plane. The record does not specify which URI patterns trigger the bypass.

Impact

An unauthenticated remote attacker gains access to functionality that should require authentication, with CVSS 3.0 scoring confidentiality, integrity and availability impacts as high. Full compromise of the management platform is possible depending on what the bypassed endpoints expose.

Attack surface

Reachable over the network via HTTP(S) requests to the iMC web interface; the CVSS vector shows no privileges required and no user interaction. No authentication is needed, so any host that can reach the iMC service can attempt the bypass.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is 0.68916 (99.3rd percentile), indicating a high modeled likelihood of exploitation. References are advisory and VDB entries only; none are tagged as exploit code, so public exploit availability is not confirmed by this record.

What to do

• Apply the HPE vendor advisory fix for iMC PLAT 7.2 E0403P06 (hpesbhf03716en_us) or upgrade to a supported release.
• Restrict network access to the iMC web interface to trusted management networks and administrative jump hosts.
• Place iMC behind a reverse proxy or WAF and block requests with malformed or unexpected URI strings targeting UrlAccessController paths.
• Audit iMC accounts and sessions for unauthorized access, and rotate credentials if compromise is suspected.
• Monitor the vendor advisory for updated affected-version guidance, since the record names only one build.

Detection

• Review iMC web access logs for requests to UrlAccessController or doFilter paths that return success without a prior authenticated session.
• Alert on HTTP requests containing unusual or malformed URI strings that reach protected iMC endpoints.
• Correlate iMC access logs with authentication logs to find sessions with no matching login event.
• Monitor for post-bypass administrative actions such as configuration changes or new account creation from unexpected source IPs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.