A potential security vulnerability has been identified in the disk drive firmware…
Priority LOW 35Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A potential security vulnerability has been identified in the disk drive firmware installers named Supplemental Update / Online ROM Flash Component on HPE servers running Linux. The vulnerable software is included in the HPE Service Pack for ProLiant (SPP) releases 2018.06.0, 2018.09.0, and 2018.11.0. The vulnerable software is the Supplemental Update / Online ROM Flash Component for Linux (x64) software. The installer in this software component could be locally exploited to execute arbitrary code. Drive Models can be found in the Vulnerability Resolution field of the security bulletin. The 2019_03 SPP and Supplemental update / Online ROM Flash Component for Linux (x64) after 2019.03.0 has fixed this issue.
Why it matters now
EPSS 0.0053 45th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Hewlett Packard Enterprise (HPE) | HPE Service Pack for ProLiant | 2018.06.0; 2018.09.0; 2018.11.0 | — | No fix listed | CNA |
| Hewlett Packard Enterprise (HPE) | HPE Server Solid State Drives | HPG2 | — | No fix listed | CNA |
| Hewlett Packard Enterprise (HPE) | HPE Server SAS Hard Drives | HPG2 | — | No fix listed | CNA |
| Hewlett Packard Enterprise (HPE) | HPE Server SATA Hard Drives | HPG2 | — | No fix listed | CNA |
| Hewlett Packard Enterprise (HPE) | HPE SATA Read Intensive Solid State Drives | HPG2 | — | No fix listed | CNA |
| Hewlett Packard Enterprise (HPE) | HPE NVMe Mixed Use Solid State Drives | HPG2 | — | No fix listed | CNA |
| Hewlett Packard Enterprise (HPE) | HPE Business Critical Hard Drives | HPG2 | — | No fix listed | CNA |
| Hewlett Packard Enterprise (HPE) | HPE Server Enterprise Hard Drives | HPG2 | — | No fix listed | CNA |
- HPE Service Pack for ProLiant VendorHewlett Packard Enterprise (HPE) Affected 2018.06.0; 2018.09.0; 2018.11.0 Fixed in — No fix listed CNA
- HPE Server Solid State Drives VendorHewlett Packard Enterprise (HPE) Affected HPG2 Fixed in — No fix listed CNA
- HPE Server SAS Hard Drives VendorHewlett Packard Enterprise (HPE) Affected HPG2 Fixed in — No fix listed CNA
- HPE Server SATA Hard Drives VendorHewlett Packard Enterprise (HPE) Affected HPG2 Fixed in — No fix listed CNA
- HPE SATA Read Intensive Solid State Drives VendorHewlett Packard Enterprise (HPE) Affected HPG2 Fixed in — No fix listed CNA
- HPE NVMe Mixed Use Solid State Drives VendorHewlett Packard Enterprise (HPE) Affected HPG2 Fixed in — No fix listed CNA
- HPE Business Critical Hard Drives VendorHewlett Packard Enterprise (HPE) Affected HPG2 Fixed in — No fix listed CNA
- HPE Server Enterprise Hard Drives VendorHewlett Packard Enterprise (HPE) Affected HPG2 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hp:service_pack_for_proliant:2018.06.0:*:*:*:*:*:*:* | 2018.06.0 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:a:hp:service_pack_for_proliant:2018.09.0:*:*:*:*:*:*:* | 2018.09.0 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:a:hp:service_pack_for_proliant:2018.11.0:*:*:*:*:*:*:* | 2018.11.0 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:a:hp:service_pack_for_proliant:2019.03.0:*:*:*:*:*:*:* | 2019.03.0 | Vulnerable | Hewlett Packard Enterprise |
- cpe:2.3:a:hp:service_pack_for_proliant:2018.06.0:*:*:*:*:*:*:* Versions 2018.06.0 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:a:hp:service_pack_for_proliant:2018.09.0:*:*:*:*:*:*:* Versions 2018.09.0 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:a:hp:service_pack_for_proliant:2018.11.0:*:*:*:*:*:*:* Versions 2018.11.0 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:a:hp:service_pack_for_proliant:2019.03.0:*:*:*:*:*:*:* Versions 2019.03.0 Vulnerable ·Hewlett Packard Enterprise
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2020-7135
- 2026-10-03 Alias added: GHSA-r3mc-836c-4x5x
References
More Hewlett Packard Enterprise (HPE) vulnerabilities
- TI-2025-25062 A remote code execution issue exists in HPE OneView. KEVCVSS 3.1CRITICAL 10.0
- TI-2017-03684 Improper privilege management in Intel Active Mangement Technology, Intel Small Business… KEVCVSS 3.1CRITICAL 9.8
- TI-2015-04610 Assertion failure in ISC BIND named via TKEY queries KEVCVSS 3.1HIGH 7.5
- TI-2024-35876 Path traversal in Hewlett Packard Enterprise (HPE) HPE Insight Remote Support CVSS 3.1CRITICAL 9.8
- TI-2020-05748 A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could… CVSS 3.1CRITICAL 9.8
- TI-2024-35875 XML injection in Hewlett Packard Enterprise (HPE) HPE Insight Remote Support CVSS 3.1HIGH 7.5
Sources
- CVE-2020-7135 · CVE Program
- CVE-2020-7135 · NVD
- FIRST EPSS
- GHSA-r3mc-836c-4x5x · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences