A potential security vulnerability has been identified in HPE Superdome Flex and…
Priority LOW 29Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 Servers. The vulnerability could be locally exploited to allow an user with Administrator access to escalate their privilege. The vulnerability is resolved in the latest firmware update. HPE Superdome Flex Server Version 3.50.58 or later, HPE Superdome Flex 280 Server Version 1.20.204 or later.
Why it matters now
EPSS 0.00237 14th percentileScored 2026-11-07
Fix Fixed HPE Superdome Flex Server; HPE Superdome Flex 280 Server: 3.50.58, 1.20.204
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | HPE Superdome Flex Server; HPE Superdome Flex 280 Server | before 3.50.58; before 1.20.204 | 3.50.58, 1.20.204 | Patch available | CNA |
- HPE Superdome Flex Server; HPE Superdome Flex 280 Server Vendor— Affected before 3.50.58; before 1.20.204 Fixed in 3.50.58, 1.20.204 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:hpe:superdome_flex_server_firmware:*:*:*:*:*:*:*:* | before 3.50.58 | Vulnerable | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:h:hpe:superdome_flex_server:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:o:hpe:superdome_flex_280_server_firmware:*:*:*:*:*:*:*:* | before 1.20.204 | Vulnerable | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:h:hpe:superdome_flex_280_server:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise (HPE) |
- cpe:2.3:o:hpe:superdome_flex_server_firmware:*:*:*:*:*:*:*:* Versions before 3.50.58 Vulnerable ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:h:hpe:superdome_flex_server:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:o:hpe:superdome_flex_280_server_firmware:*:*:*:*:*:*:*:* Versions before 1.20.204 Vulnerable ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:h:hpe:superdome_flex_280_server:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise (HPE)
Remediation
- Fix · CNA HPE Superdome Flex Server; HPE Superdome Flex 280 Server Fixed in 3.50.58, 1.20.204
Timeline
- 2026-10-02 Threatist record created from CVE-2022-23702
- 2026-10-03 Alias added: GHSA-g5xf-pvjp-4m82
References
More Hewlett Packard Enterprise (HPE) Superdome Flex 280 Server Firmware vulnerabilities
- TI-2022-17670 A potential security vulnerability has been identified in HPE Superdome Flex and… CVSS 3.1MEDIUM 5.5
Sources
- CVE-2022-23702 · CVE Program
- CVE-2022-23702 · NVD
- FIRST EPSS
- GHSA-g5xf-pvjp-4m82 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences