HPE Security Advisory
Published Date: Not specified
Advisory Summary
💡 ➤ Update Summary: ClearPass Policy Manager “PHP2Shell” Remote Code Execution (RCE)
HPE has released HPESBNW05171 rev.1 addressing multiple vulnerabilities in PHP that could enable unauthenticated Remote Code Execution (RCE) in HPE Networking ClearPass Policy Manager. These issues are specifically associated with the “PHP2Shell” technique, which may allow attackers to deploy or execute malicious code without valid credentials.
- Unauthenticated access means an attacker may not need to obtain credentials first.
- RCE risk can lead to full compromise of the appliance/VM, including credential theft, lateral movement, data exfiltration, and persistence.
- ClearPass environments often integrate with enterprise identity and network access controls, raising downstream blast radius.
- Confirm your ClearPass Policy Manager version/build against the bulletin’s applicability table.
- Identify whether the system exposes management interfaces or relevant web endpoints to untrusted networks (even indirectly via reverse proxies/load balancers).
- Restrict inbound access to ClearPass to trusted IPs only.
- Ensure management/web interfaces are not reachable from the public internet.
- Tighten firewall rules around TCP/HTTP(S)/management ports used by ClearPass.
- Maintain a regular patch cadence for ClearPass and its components (especially web/PHP runtime layers).
- Use WAF/IPS controls where available, and ensure rulesets cover common web-shell/RCE patterns.
- Enforce least-privilege administrative access and segregate admin networks.
đź“Ś
Reference: Vendor Advisory