HPE Intelligent Management Center: Authentication bypass

Summary

HPE Intelligent Management Center (iMC) versions prior to 7.3 E0713 contain an authentication bypass. A remote attacker with network access to iMC can bypass authentication without privileges or user interaction. Successful exploitation can affect the confidentiality and integrity of the management platform, which controls network infrastructure. As of the reviewed sources, no exploitation or public proof-of-concept is reported.

Affected

• Intelligent Management Center (iMC) prior to 7.3 E0713
• Versions beyond the boundary: unknown; no patch listing for earlier branches found

Fixed in

• Intelligent Management Center 7.3 E0713 (per HPE bulletin HPESBNW05157)

Workaround

Unknown. No interim mitigation is documented; the update is the only documented remedy.

Exploitation

• HPE describes the flaw as remotely exploitable for authentication bypass.
• CISA SSVC: Automatable yes, Technical Impact total, Exploitation none.
• No public proof-of-concept or known exploitation reported by the sources reviewed.
• Not in CISA KEV according to a third-party aggregator (not verified directly).
• Reported by Nhi Nguyen (credited by HPE).
• Italy's CSIRT (ACN) issued an alert rating the flaw critical.

Our recommendation

• Check whether iMC is installed in your environment.
• If iMC is present, update to 7.3 E0713 as a priority, especially if it is reachable from untrusted networks, VPN, partner access or a DMZ.
• Restrict access to the iMC web interface to a dedicated admin network.
• Review access logs for unexpected administrative sessions.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• HPE bulletin HPESBNW05157 support.hpe.com
• VulDB vuldb.com
• Strix CVE record www.strix.ai
• Vulners VulnRichment vulners.com
• ACN alert (Italy) www.acn.gov.it
• SecurityOnline securityonline.info

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:11.