CVE-2020-7135

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A potential security vulnerability has been identified in the disk drive firmware installers named Supplemental Update / Online ROM Flash Component on HPE servers running Linux. The vulnerable software is included in the HPE Service Pack for ProLiant (SPP) releases 2018.06.0, 2018.09.0, and 2018.11.0. The vulnerable software is the Supplemental Update / Online ROM Flash Component for Linux (x64) software. The installer in this software component could be locally exploited to execute arbitrary code. Drive Models can be found in the Vulnerability Resolution field of the security bulletin. The 2019_03 SPP and Supplemental update / Online ROM Flash Component for Linux (x64) after 2019.03.0 has fixed this issue.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published: Apr 27, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-71369.8A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access. Hewlett Packard En CVE-2020-71376.7A validation issue in HPE Superdome Flex's RMC component may allow local elevation of privilege. Apply HPE Superdome Flex Server version 3.2 CVE-2020-71388.8Potential remote code execution security vulnerabilities have been identified with HPE Nimble Storage systems that could be exploited by an CVE-2020-71398.1Potential remote access security vulnerabilities have been identified with HPE Nimble Storage systems that could be exploited by an attacker CVE-2020-71406.1A security vulnerability in HPE IceWall SSO Dfw and Dgfw (Domain Gateway Option) could be exploited remotely to cause a remote cross-site sc CVE-2020-71419.8A adddevicetoview expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC CVE-2020-71429.8A eventinfo_content expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (i CVE-2020-71439.8A faultdevparasset expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iM CVE-2020-71449.8A comparefilesresult expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (CVE-2020-71459.8A chooseperfview expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC)CVE-2020-71469.8A devgroupselect expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center (iMC)CVE-2020-71479.8A deployselectbootrom expression language injection remote code execution vulnerability was discovered in HPE Intelligent Management Center