CVE-2021-29203: HPE Edgeline Infrastructure Manager authentication bypass allows command execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network reachability, no authentication or interaction, and a public exploit reference make this a high-urgency patch despite absence from KEV.

What it is

HPE Edgeline Infrastructure Manager before version 1.22 contains a missing-authentication flaw (CWE-306) in a critical function. An unauthenticated remote attacker can bypass remote authentication and then execute arbitrary commands, gain privileged access, cause denial of service, and change configuration. The vendor has released a software update fixing the issue.

Impact

An attacker gains privileged access to the management software and can run arbitrary commands, alter configuration, and disrupt availability. Because the product manages edge infrastructure, compromise can extend to the managed devices.

Attack surface

Reachable over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The flaw sits in a critical function that fails to enforce authentication.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.68293, 99.3rd percentile) and a public exploit reference exists (Tenable TRA-2021-15), indicating meaningful exploitation likelihood. No ransomware association is documented.

What to do

• Upgrade HPE Edgeline Infrastructure Manager to version 1.22 or later per the HPE advisory.
• If immediate patching is not possible, restrict network access to the management interface to trusted administrative networks only.
• Place the management interface behind a VPN or jump host and block exposure to the internet.
• Audit and rotate credentials and review configuration for unauthorized changes on any instance that was internet-exposed.
• Monitor HPE advisories for follow-up updates to the fix.

Detection

• Review web and application logs for requests to critical management endpoints that succeed without an authenticated session.
• Alert on unexpected process or command execution spawned by the Edgeline Infrastructure Manager service.
• Monitor for configuration changes and new privileged accounts on the management host.
• Hunt for scanning or exploit attempts against the management interface from untrusted source IPs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.