CVE-2022-38130

What it actually does

This vulnerability allows an unauthenticated remote attacker to invoke the Keysight Sensor Management Server database restore function and supply an attacker-controlled UNC path as the source ZIP file. Because the restore process trusts the supplied path, the server can be forced to retrieve and restore a malicious HSQLDB database from an attacker-controlled SMB share. This can give the attacker control over SMS database contents, potentially enabling unauthorized account creation, credential or configuration manipulation, data exposure, service disruption, and downstream compromise of managed sensor infrastructure. Use of a UNC path may also cause the server to initiate outbound SMB authentication to the attacker-controlled host, creating a risk of credential relay or hash capture depending on system configuration.

Why it matters to the business

Successful exploitation can let an external attacker take over or corrupt the management database used by Keysight Sensor Management Server, which may disrupt sensor management operations, expose sensitive configuration data, or allow unauthorized administrative access. The vulnerability is high severity, remotely exploitable without authentication, and has weaponized exploit maturity with a high EPSS score, so exposed systems should be treated as urgent even though it is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies an exposed Keysight Sensor Management Server instance with the vulnerable ResourceManager restore interface reachable over the network. The attacker prepares a malicious HSQLDB database ZIP file and hosts it on an SMB share using a UNC path such as \\attacker-host\sms\attacker-db.zip. The attacker then invokes the unauthenticated smsRestoreDatabaseZip() method and passes that UNC path as the restore source. The SMS server connects to the attacker-controlled share, retrieves the ZIP file, and restores the supplied database content. After the restore, the attacker can attempt to use modified database state, such as injected users, credentials, roles, configuration, or corrupted records, to gain access, alter operations, extract data, or deny service. In some environments, the outbound SMB connection itself may also expose Windows authentication material that can be captured or relayed.

How to fix it

Apply the vendor-provided security update or fixed release for Keysight Sensor Management Server as soon as available; no exact fixed version was provided in the input. If immediate patching is not possible, restrict network access to the SMS management interfaces so only trusted administrative networks can reach them, block unauthenticated access to the ResourceManager restore functionality, and disable or tightly control any database restore capability that accepts remote paths. Prevent the SMS server from making outbound SMB connections to untrusted networks by blocking TCP/445 and TCP/139 egress at host and network firewalls. Where feasible, disable NTLM outbound authentication to untrusted hosts. Review SMS administrative accounts, roles, and configuration after remediation because exploitation may have altered database contents.

How to confirm the fix worked

Confirm the installed Keysight Sensor Management Server version is no longer affected according to Keysight advisories or support guidance. From a controlled test host, verify that the database restore function cannot be called without authentication and that restore sources are restricted to trusted local paths or validated locations. Attempting to provide a benign UNC path should be rejected and should not cause the SMS server to initiate outbound SMB traffic. Review firewall, EDR, and packet-capture telemetry during validation to ensure the server does not connect to arbitrary SMB shares. After patching, compare SMS user accounts, roles, sensor configuration, and database integrity against known-good backups or administrative records.

Typical attack path

1. Identify an internet-facing or internally reachable Keysight Sensor Management Server instance.
2. Confirm that the vulnerable unauthenticated ResourceManager database restore method is accessible.
3. Create or modify an HSQLDB database ZIP containing attacker-controlled SMS data.
4. Host the malicious ZIP file on an attacker-controlled SMB share reachable by the SMS server.
5. Invoke smsRestoreDatabaseZip() with a UNC path pointing to the malicious ZIP file.
6. Wait for the SMS server to retrieve and restore the attacker-controlled database.
7. Use the modified database state to gain unauthorized access, manipulate configuration, exfiltrate data, or disrupt SMS operations.
8. Optionally capture or relay outbound SMB authentication from the SMS server if Windows authentication is attempted.

How to detect it

Investigate application, service, web, RMI/JMX, EDR, Windows event, firewall, proxy, DNS, and network telemetry for evidence that the database restore method was called with a UNC path. Key signs include references to smsRestoreDatabaseZip, ResourceManager restore activity, database restore operations sourcing ZIP files from paths beginning with double backslashes, and outbound SMB connections from the SMS server to unfamiliar hosts. On Windows, review Security events for network logons or explicit credential use around the time of restore activity, including Event IDs 4624, 4648, and 4672, and review Sysmon Event ID 3 or EDR network telemetry for outbound connections to TCP/445 or TCP/139. Check SMB server logs, firewall logs, and DNS records for connections from SMS servers to unknown internal or external hosts. Examine SMS database state for newly created or modified administrative users, changed roles, unexpected sensor configuration changes, unusual restore timestamps, or corruption consistent with an attacker-controlled restore. If an unexpected UNC-based restore is found, treat the database as untrusted and perform credential rotation and incident response scoping.

• com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip
• ResourceManager.smsRestoreDatabaseZip
• smsRestoreDatabaseZip
• \\\\*\\sms\\*.zip
• \\sms\\
• UNC path used as SMS database restore source
• Outbound SMB connection from Keysight Sensor Management Server to TCP/445
• Outbound SMB connection from Keysight Sensor Management Server to TCP/139
• HSQLDB database restore from remote ZIP
• Windows Event ID 4624 network logon from SMS server during restore activity
• Windows Event ID 4648 explicit credential use from SMS server during restore activity
• Sysmon Event ID 3 outbound connection to port 445 from SMS server

What your security team should do

• Prioritize remediation for any Keysight Sensor Management Server instance reachable from untrusted networks because the vulnerability is unauthenticated, remotely exploitable, high impact, and has weaponized exploit maturity.
• Immediately restrict inbound access to SMS management services to trusted administrative networks or VPN-only access.
• Block outbound SMB traffic from SMS servers to the internet and other untrusted networks, especially TCP/445 and TCP/139.
• Hunt for prior exploitation by searching for smsRestoreDatabaseZip invocations with UNC paths and outbound SMB connections from SMS servers.
• Review SMS database contents for unauthorized users, changed roles, suspicious configuration changes, and unexpected restore events.
• Rotate credentials associated with SMS administration and any Windows service accounts if outbound SMB authentication to unknown hosts is observed.
• Restore from a known-good backup if database integrity cannot be trusted.
• Monitor vendor advisories and apply the fixed Keysight release when available.