HP System Management Homepage < 7

Tenable plugin 103530 flags HPE/HP System Management Homepage (SMH) versions earlier than 7.6.1 based on the product banner and maps that single version finding to a bundle of issues in advisory HPSBMU03753: one Apache HTTPD issue (CVE-2016-8743), remote XSS and DoS bugs, plus several local authentication bypass and command-execution flaws (CVE-2017-12544 through CVE-2017-12553). In plain English: if you are on 7.6.0.x or older, you inherit a messy mix of web-tier bugs and post-compromise local bugs; 7.6.1 is the floor for the fix line, with later HPE packages such as 7.6.1-9 and Windows 7.6.2.1 appearing in HPE distribution channels.

The vendor-style severity looks worse in a scanner than it does in a real enterprise because the attack chain is full of friction. The most credible remote path is not unauthenticated RCE against the box; it is web exploitation like XSS or response-splitting against an admin interface that is usually on ports 2301/2381, usually not internet-facing, and often requires an administrator to interact or already have access. The local command-execution and auth-bypass bugs matter if the host is already compromised, but that is downstream of initial access, so they should not drive the same urgency as a clean unauthenticated remote takeover.

Why this verdict

• Exposure is usually narrow: SMH lives on the management plane (2301/2381), so the reachable population is far smaller than scanner severity implies.
• The bundle is dominated by local/authenticated flaws: multiple mapped CVEs require local access or existing privileges, which means post-initial-access, not first-hop compromise.
• The remote path has user-interaction friction: the most concrete public PoC is XSS (CVE-2017-12544), which typically needs an authenticated admin to render the payload.
• Detection is version-based, not exploit-proven: Nessus explicitly says it relied on the product's self-reported version rather than testing exploitation, so operational context matters.
• No KEV or campaign evidence found: absent active exploitation, this does not justify emergency treatment at enterprise scale unless you have exposed SMH outside trusted admin networks.

Why not higher?

I am not scoring this HIGH or CRITICAL because the scary part of the bundle is diluted by real-world friction: management-plane placement, admin-only reachability, and several local-only bugs. There is no strong evidence here of a one-shot unauthenticated internet-scale takeover path being used in the wild.

Why not lower?

I am not dropping it to LOW because this is still a privileged server-management interface, and even 'just' XSS on an admin console can turn into credential theft or session hijack on the wrong network. Public PoC material and IDS/IPS signatures mean defenders should treat it as real, just not urgent by default.

1. Fence SMH to admin networks only — Restrict 2301/2381 to jump hosts, VPN concentrators, or dedicated management VLANs. For a MEDIUM verdict there is no mitigation SLA — go straight to the 365-day remediation window, but if you find any exposure beyond trusted admin enclaves, close that gap immediately because reachability is the main amplifier.
2. Disable the insecure redirect path if unused — If your build and operational model allow it, remove unnecessary exposure on 2301 and force administrators to the controlled HTTPS path only. This reduces casual discovery and cuts down on the most common unauthenticated entry point while you work through the 365-day remediation window.
3. Isolate privileged browsing — Have admins access SMH from hardened admin workstations or jump hosts, not from general-purpose browsers. That specifically lowers the value of the XSS/session-theft path during the MEDIUM remediation cycle.
4. Watch for suspicious SMH web requests — Add log review or detections for unusual requests to pages like gsearch.php, odd query strings, and unexpected admin actions originating from non-admin subnets. There is no mitigation SLA for MEDIUM, but instrumenting this now gives you coverage while patching lands inside the remediation window.
5. Retire legacy SMH where possible — Some orgs keep SMH installed simply because it has always been there. If you no longer use it, remove it rather than carrying an old management surface through the 365-day remediation window.

Run this from an auditor workstation or jump host that can reach the SMH web interface. Invoke it as python3 check_hpsmh_761.py https://server01:2381/ or python3 check_hpsmh_761.py http://server01:2301/; no local admin rights are required, but you need network reachability to the target.

#!/usr/bin/env python3
# check_hpsmh_761.py
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/network error

import re
import sys
import ssl
import urllib.request
import urllib.error
from html import unescape
from urllib.parse import urlparse

TIMEOUT = 8
TARGET_FLOOR = (7, 6, 1)
VERSION_RE = re.compile(r'\b(\d+)\.(\d+)\.(\d+)(?:\.(\d+))?\b')


def normalize_url(url: str) -> str:
    if not re.match(r'^https?://', url, re.I):
        return 'https://' + url
    return url


def version_tuple(v: str):
    m = VERSION_RE.search(v)
    if not m:
        return None
    parts = [int(x) if x is not None else 0 for x in m.groups()]
    return tuple(parts)


def is_vulnerable(vtuple):
    if vtuple is None:
        return None
    # Compare only major.minor.patch floor; build suffixes do not change the 7.6.1 cutoff logic
    return vtuple[:3] < TARGET_FLOOR


def fetch(url: str):
    ctx = ssl.create_default_context()
    ctx.check_hostname = False
    ctx.verify_mode = ssl.CERT_NONE
    req = urllib.request.Request(url, headers={"User-Agent": "noisgate-hpsmh-check/1.0"})
    with urllib.request.urlopen(req, timeout=TIMEOUT, context=ctx) as resp:
        body = resp.read(1024 * 1024).decode(errors='ignore')
        headers = dict(resp.info())
        return body, headers


def extract_version(text: str):
    text = unescape(text)
    candidates = []

    # Prefer versions mentioned near HP/HPE/SMH strings
    contextual_patterns = [
        r'(?i)(?:HPE|HP)\s+System\s+Management\s+Homepage[^\d]{0,40}(' + VERSION_RE.pattern + r')',
        r'(?i)SMH[^\d]{0,40}(' + VERSION_RE.pattern + r')',
        r'(?i)Version[^\d]{0,10}(' + VERSION_RE.pattern + r')',
    ]

    for pat in contextual_patterns:
        m = re.search(pat, text)
        if m:
            ver = re.search(VERSION_RE, m.group(1))
            if ver:
                return ver.group(0)

    # Fallback: collect all plausible versions and prefer 7.x values
    for m in VERSION_RE.finditer(text):
        ver = m.group(0)
        vt = version_tuple(ver)
        if vt:
            candidates.append((ver, vt))

    seven_x = [ver for ver, vt in candidates if vt[0] == 7]
    if seven_x:
        return seven_x[0]
    return candidates[0][0] if candidates else None


def main():
    if len(sys.argv) != 2:
        print('UNKNOWN - usage: python3 check_hpsmh_761.py <url-or-host>')
        sys.exit(3)

    url = normalize_url(sys.argv[1])
    parsed = urlparse(url)
    attempts = [url]

    # If caller gave a bare host or nonstandard path, try common SMH URLs too
    base_host = parsed.netloc or parsed.path
    if base_host and parsed.scheme in ('http', 'https'):
        attempts.extend([
            f'https://{base_host}/',
            f'https://{base_host}:2381/',
            f'http://{base_host}:2301/'
        ])

    seen = set()
    last_error = None

    for attempt in attempts:
        if attempt in seen:
            continue
        seen.add(attempt)
        try:
            body, headers = fetch(attempt)
            combined = body + '\n' + '\n'.join(f'{k}: {v}' for k, v in headers.items())
            version = extract_version(combined)
            if not version:
                continue
            vt = version_tuple(version)
            verdict = is_vulnerable(vt)
            if verdict is True:
                print(f'VULNERABLE - detected SMH version {version} at {attempt}')
                sys.exit(1)
            elif verdict is False:
                print(f'PATCHED - detected SMH version {version} at {attempt}')
                sys.exit(0)
        except urllib.error.HTTPError as e:
            last_error = f'HTTP {e.code} on {attempt}'
        except urllib.error.URLError as e:
            last_error = f'URL error on {attempt}: {e.reason}'
        except Exception as e:
            last_error = f'Error on {attempt}: {e}'

    if last_error:
        print(f'UNKNOWN - could not confirm version ({last_error})')
    else:
        print('UNKNOWN - target reachable but SMH version not found in response')
    sys.exit(2)


if __name__ == '__main__':
    main()

Sources

1. Tenable Nessus Plugin 103530
2. NVD CVE-2017-12544
3. NVD affected-product search results for HP System Management Homepage
4. Bugtraq PoC for CVE-2017-12544
5. Sophos IPS Signature Release Note V9.17.79
6. CVE Details for CVE-2017-12544
7. CVE Details for CVE-2017-12553
8. HPE System Management Homepage ports and behavior reference