| Advisory | HSA-26-0002 |
|---|---|
| Published | June 12, 2026 |
| Severity | High CVSS v3.1 base score 7.5 |
| Fixed in | H-BMC 2.24 and later. |
Overview
A remote, unauthenticated attacker who can reach the management port can cause the H-BMC to restart repeatedly by sending a malformed request, making remote management unavailable. Host operation is not affected.
Affected Products
| Product | Versions |
|---|---|
| HS-2208, HS-2212, HS-2224, HS-2208S | H-BMC 2.10 to 2.23 |
| HS-1104, HS-1108S | H-BMC 2.10 to 2.23 |
Description
The H-BMC management controller does not correctly check the length of a field in one type of management request. A request with an invalid length causes the controller's web service to fail and the controller to restart. Repeated requests keep the controller in a restart loop.
The server's operating system and workloads continue to run. Remote management, sensor monitoring and alerting, including alerts through an SL1 Service Link module, are unavailable while the controller is restarting.
Remediation and Mitigation
Update the H-BMC to version 2.24 or later. The update is available from Downloads, or from your Hosaka sales representative for integrated systems built to a customer configuration.
Connect the management port only to a dedicated management network that cannot be reached from untrusted networks. This is our standing recommendation for every product with a management controller.
Acknowledgement and History
Hosaka thanks a customer's security team, who reported this vulnerability and asked not to be named.
- Published
This advisory is provided "as is" for information. Hosaka may update it as new information becomes available. Contact: Hosaka PSIRT, psirt@hosakacorporation.com.