Security readout for executives and security teams
Plain-English summary
This CVE affects legacy HP OpenVMS systems on Itanium and Alpha platforms. A flaw in login-related components can let a remote attacker cause a denial of service. The public record does not provide severity, CVSS scoring, exploit details, or confirmed active exploitation.
Executive priority
Treat this as a targeted legacy-platform availability risk. It is not broadly internet-scale based on the provided sources, but affected OpenVMS systems may support critical operations. Prioritize inventory confirmation and vendor-advisory review before committing emergency action.
Technical view
HP OpenVMS listed versions improperly implement the LOGIN and ACME_SERVER ACMELOGIN programs. The documented impact is remote denial of service through unspecified vectors. Affected versions include OpenVMS 8.3, 8.3-1H1, and 8.4 on Itanium, and 7.3-2, 8.2, 8.3, and 8.4 on Alpha.
Likely exposure
Exposure appears limited to organizations still operating the listed HP OpenVMS versions on Itanium or Alpha systems. The provided affected-product metadata is sparse, so teams should verify platform, version, and vendor advisory applicability directly against their asset inventory.
Exploitation context
The sources do not report active exploitation, and this CVE is not marked as CISA KEV. The issue is described as remotely triggerable denial of service, but the public source bundle does not describe attacker prerequisites, affected configurations, or technical vectors.
Researcher notes
Public details are limited. The record identifies affected OpenVMS versions and login-related programs but leaves vectors unspecified. No CVSS, CWE, exploit evidence, or remediation text is included in the source bundle beyond the HP advisory reference.
Mitigation direction
- Check HP advisory SSRT101055 for official fixes and applicability.
- Inventory OpenVMS Alpha and Itanium systems for listed versions.
- Apply only vendor-published fixes or mitigations confirmed for this advisory.
- Track unsupported systems as residual operational risk until vendor guidance is resolved.
Validation and detection
- Confirm OpenVMS platform architecture and version on each relevant host.
- Map each affected host to HP advisory SSRT101055 applicability.
- Review authentication-service availability monitoring for unexplained outages.
- Record whether vendor guidance has been applied or formally risk-accepted.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2012-3277 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- SSRT101055CVE reference · vendor-advisory, x_refsource_HP
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.