Security readout for executives and security teams
Plain-English summary
This is a critical unauthenticated remote command execution issue in H3C iMC. A reachable BYOD endpoint may let an attacker execute arbitrary commands without credentials or session cookies. For organizations using H3C iMC, the business risk is potential takeover of a network-management platform.
Executive priority
Treat this as urgent for any organization running H3C iMC. A network-management system compromise can affect visibility, configuration integrity, and downstream infrastructure trust. Internet-facing exposure should be addressed first while vendor guidance is confirmed.
Technical view
The flaw is described as improper JSF ViewState handling at /byod/index.xhtml, mapped to CWE-502. The bundle states attackers can craft POST requests with forged javax.faces.ViewState values, potentially causing command execution. Versions up to and including E0632H07 are named, but the affected range is otherwise undefined.
Likely exposure
Systems running H3C Intelligent Management Center with /byod/index.xhtml reachable from untrusted networks are the primary concern. Exposure is highest for internet-facing or broadly reachable management portals. The product/version data is incomplete, so inventory validation matters.
Exploitation context
Public exploit-tagged references exist in the bundle. The CVE is not marked KEV. The bundle reports exploitation evidence first observed by Shadowserver on 2024-08-28, but no direct Shadowserver URL is provided here, so current active exploitation is not independently confirmed from this bundle.
Researcher notes
Evidence is strong for vulnerability class and endpoint, but incomplete for exact version boundaries and remediation. Avoid assuming a patch name from this bundle. Public exploit-tagged references indicate reproducibility risk, so defensive validation should focus on inventory, exposure, and logs.
Mitigation direction
- Identify all H3C iMC instances and versions, especially E0632H07 or earlier.
- Restrict /byod/index.xhtml and management access to trusted administrative networks.
- Check H3C PSIRT and vendor support channels for fixed versions or official mitigations.
- Monitor logs for suspicious unauthenticated POST activity to /byod/index.xhtml.
- Prioritize patching or compensating controls for externally reachable systems.
Validation and detection
- Confirm whether H3C iMC is deployed and whether BYOD endpoints are enabled.
- Review perimeter exposure for /byod/index.xhtml from untrusted networks.
- Check product build/version against E0632H07 and vendor guidance.
- Search application and proxy logs for unexpected POST requests to the endpoint.
- Validate that management access controls block unauthenticated external reachability.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-502: Code execution behavior lookup
Code execution and unsafe deserialization weaknesses often justify reviewing execution behavior and process telemetry. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2024-13980 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 10 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
10CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://blog.csdn.net/nnn2188185/article/details/141065540CVE reference, VulnCheck · exploit
- https://github.com/OJZen/FckESC/blob/master/%E5%86%85%E7%BD%91%E7%99%BB%E5%BD%95%E8%BF%87%E7%A8%8B.txtCVE reference, VulnCheck · technical-description, exploit
- https://blog.csdn.net/weixin_48539059/article/details/141033966CVE reference, VulnCheck · technical-description, exploit
- https://axsec.blog.csdn.net/article/details/141003376CVE reference, VulnCheck · technical-description, exploit
- https://www.h3c.com/cn/Service/Online_Help/psirt/CVE reference, VulnCheck · product
- https://www.vulncheck.com/advisories/h3c-intelligent-management-center-rceCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Deserialization of Untrusted Data
Deserialization of Untrusted Data represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.