Daily Archives: September 30, 2020

If your organization uses HP Device Manager to control thin clients, you need to plug this hole now

Posted on September 30, 2020 at 05:01 CDT by woody • Comment in the Forums

News early this morning from Thomas Claburn at The Register

HP Device Manager, software that allows IT administrators to manage HP Thin Client devices, comes with a backdoor database user account… the account can be exploited to achieve privilege escalation and, in conjunction with other flaws, gain unauthorized remote command execution as SYSTEM.

This is bad: if you can reach a vulnerable installation of this device manager on a network, you can gain admin-level control over its machine and the thin clients it controls. HPDM typically runs on a Windows-powered server, and directs multiple Windows clients.

HP just updated its security bulletin HPSBHF03689.

There’s an updated HP Device Manager coming. In the interim, make sure you follow the HP remediation steps — and close up the hole manually following @nickstadb ‘s steps in The Reg.

Windows Patches/Security CVE-2020-6926, HP Device Manager

Plus Membership

Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.

AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.

Welcome to our unique respite from the madness.

It's easy to post questions about Windows 11, Windows 10, Win8.1, Win7, Surface, Office, or browse through our Forums. Post anonymously or register for greater privileges. Keep it civil, please: Decorous Lounge rules strictly enforced. Questions? Contact Customer Support.

S	M	T	W	T	F	S
		1	2	3	4	5
6	7	8	9	10	11	12
13	14	15	16	17	18	19
20	21	22	23	24	25	26
27	28	29	30

Daily Archives: September 30, 2020

If your organization uses HP Device Manager to control thin clients, you need to plug this hole now

Plus Membership

Search Newsletters

Search Forums

View the Forum

Search for Topics

Recent Topics

Recent blog posts

My Profile

Key Links

Remembering Woody

Daily Archives: September 30, 2020

If your organization uses HP Device Manager to control thin clients, you need to plug this hole now

Plus Membership

Search Newsletters

Search Forums

View the Forum

Search for Topics

Recent Topics

Recent blog posts

My Profile

Login and Registration

Key Links

Remembering Woody