CVE-2020-7135
A potential security vulnerability has been identified in the disk drive firmware installers named Supplemental Update / Online ROM Flash…
- Published
- Updated
- Reserved
- Assigned by
- hpe
Description
A potential security vulnerability has been identified in the disk drive firmware installers named Supplemental Update / Online ROM Flash Component on HPE servers running Linux. The vulnerable software is included in the HPE Service Pack for ProLiant (SPP) releases 2018.06.0, 2018.09.0, and 2018.11.0. The vulnerable software is the Supplemental Update / Online ROM Flash Component for Linux (x64) software. The installer in this software component could be locally exploited to execute arbitrary code. Drive Models can be found in the Vulnerability Resolution field of the security bulletin. The 2019_03 SPP and Supplemental update / Online ROM Flash Component for Linux (x64) after 2019.03.0 has fixed this issue.
Timeline
ID reserved
By hpe
- 3 months later
· 3 months later
Published
- 4 years later
· 4 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.53% · top 55% of all CVEs (7 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Weakness
- local execution of arbitrary code with privilege elevation
Affected products
HPE · HPE Service Pack for ProLiant
- affected 2018.06.0
- affected 2018.09.0
- affected 2018.11.0
HPE · HPE Server Solid State Drives
- affected HPG2
HPE · HPE Server SAS Hard Drives
- affected HPG2
HPE · HPE Server SATA Hard Drives
- affected HPG2
HPE · HPE SATA Read Intensive Solid State Drives
- affected HPG2
HPE · HPE NVMe Mixed Use Solid State Drives
- affected HPG2
HPE · HPE Business Critical Hard Drives
- affected HPG2
HPE · HPE Server Enterprise Hard Drives
- affected HPG2
References (1)
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03945en_us (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2020-7135)Record last updated .