The AppendStringToFile function in the HPISDataManagerLib.Datamgr ActiveX control in…
Priority MEDIUM 48Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- —
- Confidentiality · integrity · availability
- Complete · Complete · Complete
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
The AppendStringToFile function in the HPISDataManagerLib.Datamgr ActiveX control in HPISDataManager.dll in HP Instant Support before 1.0.0.24 allows remote attackers to create files with arbitrary content via a full pathname in the first argument and the content in the second argument, a different vulnerability than CVE-2007-5608 and CVE-2008-0953.
Why it matters now
EPSS 0.05529 92nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hp:instant_support:*:*:*:*:*:*:*:* | up to 1.0.0.23 | Vulnerable | Hewlett Packard Enterprise |
- cpe:2.3:a:hp:instant_support:*:*:*:*:*:*:*:* Versions up to 1.0.0.23 Vulnerable ·Hewlett Packard Enterprise
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2008-0952
- 2026-10-03 Alias added: GHSA-c9m8-8cfg-x353
References
More Hewlett Packard Enterprise Instant Support vulnerabilities
- TI-2007-05389 Buffer overflow in the MoveFile function in the HPISDataManagerLib.Datamgr ActiveX… CVSS 2.0HIGH 10.0
- TI-2008-00915 The StartApp function in the HPISDataManagerLib.Datamgr ActiveX control in… CVSS 2.0HIGH 10.0
- TI-2007-05392 The DeleteSingleFile function in the HPISDataManagerLib.Datamgr ActiveX control in… CVSS 2.0HIGH 10.0
- TI-2007-05388 Buffer overflow in the GetFileTime function in the HPISDataManagerLib.Datamgr ActiveX… CVSS 2.0HIGH 9.3
- TI-2007-03447 Stack-based buffer overflow in the HPSDDX Class (SDD) ActiveX control in sdd.dll in HP… CVSS 2.0HIGH 7.6
- TI-2007-05390 Buffer overflow in the RegistryString function in the HPISDataManagerLib.Datamgr ActiveX… CVSS 2.0HIGH 7.5
Sources
- CVE-2008-0952 · CVE Program
- CVE-2008-0952 · NVD
- FIRST EPSS
- GHSA-c9m8-8cfg-x353 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences