CVE-2015-2902: HP ArcSight SmartConnectors before 7.1.6 do not verify X.509 certificates from Logger devices, which allows...

Security readout for executives and security teams

HP ArcSight SmartConnectors before 7.1.6 did not properly verify certificates from Logger devices. An attacker positioned between the connector and Logger could impersonate a Logger device and potentially capture sensitive information. The sources do not provide CVSS scoring or evidence of active exploitation. Exposure is most likely in environments still running HP ArcSight SmartConnectors earlier than 7.1.6 and connecting them to Logger devices across networks where interception is plausible. Prioritize remediation where ArcSight infrastructure handles sensitive logs or spans less trusted networks. The business risk is confidentiality loss from security telemetry systems, but urgency is lower if affected versions are absent. Mitigation focus: Identify all HP ArcSight SmartConnector versions in use.; Upgrade SmartConnectors before 7.1.6 to 7.1.6 or later.; Review HPE advisory guidance for supported upgrade paths..

Prepared

Jun 13, 2026, 21:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.