How severe is CVE-2019-5408?

CVE-2019-5408 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.

Is CVE-2019-5408 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (72nd percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2019-5408?

CVE-2019-5408 primarily affects Hp Xp7 Device Manager. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2019-5408?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2019-5408 published?

CVE-2019-5408 was published on 2019-08-09 and last updated on 2026-06-17.

CVE-2019-5408

CVE-2019-5408 is a medium-severity vulnerability in Hp Xp7 Device Manager with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
CVSS v2: 6.4
EPSS exploit prediction: 2% (72nd percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Hp Xp7 Device Manager
Published: 2019-08-09
Last modified: 2026-06-17

Description

Command View Advanced Edition (CVAE) products contain a vulnerability that could expose configuration information of hosts and storage systems that are managed by Device Manager server. This problem is due to a vulnerability in Device Manager GUI. The following products are affected. DevMgr version 7.0.0-00 to earlier than 8.6.1-02 RepMgr if it is installed on the same machine as DevMgr TSMgr if it is installed on the same machine as DevMgr. The resolution is to upgrade to the fixed version as described below or later version of DevMgr 8.6.2-02 or later. RepMgr and TSMgr will be corrected by upgrading DevMgr.

Frequently asked questions

What is CVE-2019-5408?: Command View Advanced Edition (CVAE) products contain a vulnerability that could expose configuration information of hosts and storage systems that are managed by Device Manager server. This problem is due to a vulnerability in Device Manager GUI. The following products are affected. DevMgr version 7.0.0-00 to earlier than 8.6.1-02 RepMgr if it is installed on the same machine as DevMgr TSMgr if it is installed on the same machine as DevMgr. The resolution is to upgrade to the fixed version as described below or later version of DevMgr 8.6.2-02 or later. RepMgr and TSMgr will be corrected by upgrading DevMgr.
How severe is CVE-2019-5408?: CVE-2019-5408 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity low, and availability none.
Is CVE-2019-5408 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (72nd percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2019-5408?: CVE-2019-5408 primarily affects Hp Xp7 Device Manager. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2019-5408?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2019-5408 published?: CVE-2019-5408 was published on 2019-08-09 and last updated on 2026-06-17.

References

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03938en_us

Affected products (3)

cpe:2.3:a:hp:xp7_device_manager:*:*:*:*:*:*:*:*
cpe:2.3:a:hp:xp7_replication_manager:-:*:*:*:*:*:*:*
cpe:2.3:a:hp:xp7_tiered_storage_manager:-:*:*:*:*:*:*:*