HPE MSA Controller prior to version IN210R004 could be remotely exploited to allow…
Priority LOW 24CWE-444Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
HPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00341 27th percentileScored 2026-11-07
Fix Fixed HPE MSA Controller (Hewlett Packer Enterprise (HPE)): IN210R004
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Hewlett Packer Enterprise (HPE) | HPE MSA Controller | before IN210R004 | IN210R004 | Patch available | CNA |
- HPE MSA Controller VendorHewlett Packer Enterprise (HPE) Affected before IN210R004 Fixed in IN210R004 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:hpe:msa_1060_storage_firmware:*:*:*:*:*:*:*:* | before in210r004 | Vulnerable | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:h:hpe:msa_1060_storage:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:o:hpe:msa_2060_storage_firmware:*:*:*:*:*:*:*:* | before in210r004 | Vulnerable | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:h:hpe:msa_2060_storage:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:o:hpe:msa_2062_storage_firmware:*:*:*:*:*:*:*:* | before in210r004 | Vulnerable | Hewlett Packard Enterprise (HPE) |
| cpe:2.3:h:hpe:msa_2062_storage:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise (HPE) |
- cpe:2.3:o:hpe:msa_1060_storage_firmware:*:*:*:*:*:*:*:* Versions before in210r004 Vulnerable ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:h:hpe:msa_1060_storage:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:o:hpe:msa_2060_storage_firmware:*:*:*:*:*:*:*:* Versions before in210r004 Vulnerable ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:h:hpe:msa_2060_storage:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:o:hpe:msa_2062_storage_firmware:*:*:*:*:*:*:*:* Versions before in210r004 Vulnerable ·Hewlett Packard Enterprise (HPE)
- cpe:2.3:h:hpe:msa_2062_storage:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise (HPE)
Remediation
- Fix · CNA HPE MSA Controller (Hewlett Packer Enterprise (HPE)) Fixed in IN210R004
Timeline
- 2026-10-02 Threatist record created from CVE-2023-30910
- 2026-10-03 Alias added: GHSA-q68p-h2v7-5w73
References
Sources
- CVE-2023-30910 · CVE Program
- CVE-2023-30910 · NVD
- FIRST EPSS
- GHSA-q68p-h2v7-5w73 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences