Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2020-7135

Quick assessment

Affected
HPE HPE Service Pack for ProLiant
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

HPE Service Pack for ProLiant是美国惠普企业公司（Hewlett Packard Enterprise，HPE）的一套综合的系统软件和固件更新解决方案。 HPE Service Pack for ProLiant 2018.06.0版本、2018.09.0版本和2018.11.0版本中的Supplemental Update/Online ROM Flash Component存在安全漏洞。本地攻击者可利用该漏洞执行任意代码。

AI Predicted 6.7 Difficulty: Moderate EPSS 0.53% · P43

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2020-7135

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A potential security vulnerability has been identified in the disk drive firmware installers named Supplemental Update / Online ROM Flash Component on HPE servers running Linux. The vulnerable software is included in the HPE Service Pack for ProLiant (SPP) releases 2018.06.0, 2018.09.0, and 2018.11.0. The vulnerable software is the Supplemental Update / Online ROM Flash Component for Linux (x64) software. The installer in this software component could be locally exploited to execute arbitrary code. Drive Models can be found in the Vulnerability Resolution field of the security bulletin. The 2019_03 SPP and Supplemental update / Online ROM Flash Component for Linux (x64) after 2019.03.0 has fixed this issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
HPE Service Pack for ProLiant 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
HPE Service Pack for ProLiant是美国惠普企业公司（Hewlett Packard Enterprise，HPE）的一套综合的系统软件和固件更新解决方案。 HPE Service Pack for ProLiant 2018.06.0版本、2018.09.0版本和2018.11.0版本中的Supplemental Update/Online ROM Flash Component存在安全漏洞。本地攻击者可利用该漏洞执行任意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
HPE HPE Service Pack for ProLiant 2018.06.0 -
HPE HPE Server Solid State Drives HPG2 -
HPE HPE Server SAS Hard Drives HPG2 -
HPE HPE Server SATA Hard Drives HPG2 -
HPE HPE SATA Read Intensive Solid State Drives HPG2 -
HPE HPE NVMe Mixed Use Solid State Drives HPG2 -
HPE HPE Business Critical Hard Drives HPG2 -
HPE HPE Server Enterprise Hard Drives HPG2 -

II. Public POCs for CVE-2020-7135

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2020-7135

请登录查看更多情报信息。

Other References for CVE-2020-7135 (1)

IV. Related Vulnerabilities

Same vendor: HPE

V. Comments for CVE-2020-7135

No comments yet

Leave a comment