Medium severity · published Nov 5, 2020
CVE-2020-7207
A local elevation of privilege using physical access security vulnerability was found in HPE Proliant Gen10 Servers using Intel Innovation Engine (IE)
6.8
CVSS
0.5%
EPSS
No
On KEV
Description
A local elevation of privilege using physical access security vulnerability was found in HPE Proliant Gen10 Servers using Intel Innovation Engine (IE). This attack requires a physical attack to the server motherboard. To mitigate this issue, ensure your server is always physically secured. HPE will not address this issue in the impacted Gen 10 servers listed. HPE recommends using appropriate physical security methods as a compensating control to disallow an attacker from having physical access to the server main circuit board.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
A2
Apollo 2000 Firmware · HP
All versions, or not specified · source: NVD
A4
Apollo 4200 Gen10 Firmware · HP
All versions, or not specified · source: NVD
A4
Apollo 4500 Firmware · HP
All versions, or not specified · source: NVD
PB
Proliant Bl460c Gen10 Firmware · HP
All versions, or not specified · source: NVD
PD
Proliant Dl120 Gen10 Firmware · HP
All versions, or not specified · source: NVD
PD
Proliant Dl160 Gen10 Firmware · HP
All versions, or not specified · source: NVD
PD
Proliant Dl180 Gen10 Firmware · HP
All versions, or not specified · source: NVD
PD
Proliant Dl360 Gen10 Firmware · HP
All versions, or not specified · source: NVD
PD
Proliant Dl380 Gen10 Firmware · HP
All versions, or not specified · source: NVD
PD
Proliant Dl560 Gen10 Firmware · HP
All versions, or not specified · source: NVD
PD
Proliant Dl580 Gen10 Firmware · HP
All versions, or not specified · source: NVD
PE
Proliant E910 Firmware · HP
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-7207
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-7207
Vendor Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04002en_us
More from Apollo 2000 Firmware
6.5
CVE-2019-11135
TSX Asynchronous Abort condition on some CPUs utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with…
