CVE-2024-13980

The vulnerability results from improper handling of the javax.faces.ViewState parameter in the JSF (JavaServer Faces) mechanism — this is an unsafe deserialization error (CWE-502). An attacker can send a crafted HTTP POST request to the /byod/index.xhtml endpoint with a forged javax.faces.ViewState parameter containing a malicious payload. The server deserializes this parameter without verifying its origin or integrity, leading to execution of arbitrary commands in the context of the application process. Exploitation does not require a valid session token or authentication cookies.

An unauthenticated remote attacker can gain full control over the server running H3C IMC by executing arbitrary system commands. As a result, it is possible to compromise the network management system, disclose configuration data, and perform lateral movement within the infrastructure managed by IMC.

Security patches available from the vendor should be applied according to the references (https://www.h3c.com/cn/Service/Online_Help/psirt/). Until the patch is implemented, it is recommended to restrict network access to the /byod/index.xhtml endpoint using firewall or ACL rules and to isolate the IMC management interface from public networks and untrusted segments.

H3C Intelligent Management Center (IMC) in versions up to and including E0632H07; the exact scope of vulnerable versions has not been definitively defined by the vendor.