CVE-2012-2986

CVE-2012-2986 describes a remote command execution vulnerability in HP SAN/iQ 9.5 on the HP Virtual SAN Appliance. Authenticated attackers can inject shell metacharacters into specific parameters of the lhn/public/network/ping utility, leading to arbitrary command execution. This vulnerability, a partial fix for CVE-2012-4361, carries a high CVSS score of 7.7, indicating a network-adjacent attack vector, low attack complexity, and complete compromise of confidentiality, integrity, and availability. While not listed on CISA's KEV catalog, public exploit code, including Metasploit modules, is available, though there is no evidence of widespread active exploitation or significant community discussion.