How severe is CVE-2019-11995?

CVE-2019-11995 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.

Is CVE-2019-11995 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (80th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2019-11995?

CVE-2019-11995 primarily affects Hp Universal Internet Of Things. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2019-11995?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2019-11995 published?

CVE-2019-11995 was published on 2019-12-18 and last updated on 2026-06-17.

CVE-2019-11995

CVE-2019-11995 is a high-severity vulnerability in Hp Universal Internet Of Things with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v2: 5.0
EPSS exploit prediction: 2% (80th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Hp Universal Internet Of Things
Published: 2019-12-18
Last modified: 2026-06-17

Description

Security vulnerabilities in HPE UIoT version 1.2.4.2 could allow unauthorized remote access and access to sensitive data. HPE has addressed this issue in HPE UIoT: For customers with release UIoT 1.2.4.2 fixes are made available with 1.2.4.2 RP3 HF1. For customers with release older than 1.2.4.2, such as 1.2.4.1, 1.2.4.0, the resolution will be to upgrade to 1.2.4.2 RP3 HF1 Customers are requested to upgrade to the updated versions or contact HPE support for further assistance.

Frequently asked questions

What is CVE-2019-11995?: Security vulnerabilities in HPE UIoT version 1.2.4.2 could allow unauthorized remote access and access to sensitive data. HPE has addressed this issue in HPE UIoT: For customers with release UIoT 1.2.4.2 fixes are made available with 1.2.4.2 RP3 HF1. For customers with release older than 1.2.4.2, such as 1.2.4.1, 1.2.4.0, the resolution will be to upgrade to 1.2.4.2 RP3 HF1 Customers are requested to upgrade to the updated versions or contact HPE support for further assistance.
How severe is CVE-2019-11995?: CVE-2019-11995 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity none, and availability none.
Is CVE-2019-11995 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (80th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2019-11995?: CVE-2019-11995 primarily affects Hp Universal Internet Of Things. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2019-11995?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2019-11995 published?: CVE-2019-11995 was published on 2019-12-18 and last updated on 2026-06-17.

References

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03954en_us

Affected products (3)

cpe:2.3:a:hp:universal_internet_of_things:1.2.4.0:*:*:*:*:*:*:*
cpe:2.3:a:hp:universal_internet_of_things:1.2.4.1:*:*:*:*:*:*:*
cpe:2.3:a:hp:universal_internet_of_things:1.2.4.2:*:*:*:*:*:*:*

More vulnerabilities in Hp Universal Internet Of Things

CVE-2019-11990 — High (CVSS 8.8): Security vulnerabilities in HPE UIoT versions 1.6, 1.5, 1.4.2, 1.4.1, 1.4.0, and 1.2.4.2 could allow unauthorized…
CVE-2018-7111 — Medium (CVSS 5.3): A remote unauthorized access vulnerability was identified in HPE UIoT versions 1.5, 1.4.0, 1.4.1, 1.4.2, 1.2.4.2.…

All CVEs affecting Hp Universal Internet Of Things →