Tuesday, April 29, 2025
HomeCVE/vulnerabilityHPE IceWall Flaw Let Attackers cause Unauthorized Data Modification

HPE IceWall Flaw Let Attackers cause Unauthorized Data Modification

Published on

SIEM as a Service

Follow Us on Google News

Hewlett Packard Enterprise (HPE) has issued an urgent security bulletin addressing a critical vulnerability in its IceWall product line.

Identified as CVE-2024-11856, this flaw could allow attackers to remotely modify data without authorization.

This flaw is capable of enabling unauthorized data modification from remote locations, posing a significant security threat to the affected systems.

- Advertisement - Google News

Vulnerability Summary

The issue at the core of CVE-2024-11856 lies in the IceWall modules’ ability to improperly manage failed password attempts.

This defect allows users to surpass the intended limit for unsuccessful login attempts, thereby gaining potential access to modify data without proper authorization.

Leveraging 2024 MITRE ATT&CK Results for SME & MSP Cybersecurity Leaders – Attend Free Webinar

The affected IceWall modules include:

  • IceWall Gen11 certd for RHEL 7, RHEL 8, and RHEL 9
  • IceWall Gen11 certd for Windows
  • IceWall SSO 10.0 certd for HP-UX

Supported Software Versions

Only the following versions are impacted:

  • IceWall Gen11 Enterprise Edition certd (RHEL 7, 8, 9, and Windows)
  • IceWall Gen11 Standard Edition certd (RHEL 7, 8, 9, and Windows)
  • IceWall SSO certd 10.0 (HP-UX)

According to HPE, the vulnerability has been assigned a CVSS v3.1 base score of 3.7, indicating a medium impact.

The vector is described as remote, with no requirement for physical access or user interaction, making it particularly concerning for enterprise environments that rely on IceWall for secure authentication.

HPE has released updated patches to mitigate this vulnerability. Users are urged to apply these patches immediately to ensure the security of their systems. The available patches include:

  • IceWall Gen11 certd Patch Release 14 for RHEL 7, 8, and 9
  • IceWall Gen11 certd Patch Release 14 for Windows
  • IceWall SSO 10.0 certd Patch Release 10 for HP-UX

For assistance in implementing these security measures, users are advised to contact HPE Services support.

Organizations using affected HPE IceWall products should prioritize the application of these patches to safeguard against potential unauthorized data modifications.

Analyse Advanced Malware & Phishing Analysis With ANY.RUN Black Friday Deals : Get up to 3 Free Licenses.

Divya
Divya
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Latest articles

Blinded from Above: How Relentless Cyber-Attacks Are Knocking Satellites Out of Sight

According to the Center for Strategic & International Studies' (CSIS) 2025 Space Threat Assessment,...

Google Chrome Vulnerability Allows Attackers to Bypass Sandbox Restrictions – Technical Details Revealed

A severe vulnerability, identified as CVE-2025-2783, has been discovered in Google Chrome, specifically targeting...

Threat Actors Accelerate Transition from Reconnaissance to Compromise – New Report Finds

Cybercriminals are leveraging automation across the entire attack chain, drastically reducing the time from...

ResolverRAT Targets Healthcare and Pharmaceutical Sectors Through Sophisticated Phishing Attacks

A previously undocumented remote access trojan (RAT) named ResolverRAT has surfaced, specifically targeting healthcare...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Blinded from Above: How Relentless Cyber-Attacks Are Knocking Satellites Out of Sight

According to the Center for Strategic & International Studies' (CSIS) 2025 Space Threat Assessment,...

Google Chrome Vulnerability Allows Attackers to Bypass Sandbox Restrictions – Technical Details Revealed

A severe vulnerability, identified as CVE-2025-2783, has been discovered in Google Chrome, specifically targeting...

Threat Actors Accelerate Transition from Reconnaissance to Compromise – New Report Finds

Cybercriminals are leveraging automation across the entire attack chain, drastically reducing the time from...