Medium severity · published Apr 1, 2021
CVE-2021-26581
A potential security vulnerability has been identified in HPE Superdome Flex server
6.5
CVSS
0.9%
EPSS
No
On KEV
Description
A potential security vulnerability has been identified in HPE Superdome Flex server. A denial of service attack can be remotely exploited leaving hung connections to the BMC web interface. The monarch BMC must be rebooted to recover from this situation. Other BMC management is not impacted. HPE has made the following software update to resolve the vulnerability in HPE Superdome Flex Server: Superdome Flex Server Firmware 3.30.142 or later.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SF
Superdome Flex Server Firmware · Hpe
before 3.30.142 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-26581
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-26581
Vendor Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04102en_us
More from Superdome Flex Server Firmware
6.7
CVE-2022-23702
A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 Servers
6.7
CVE-2020-7137
A validation issue in HPE Superdome Flex's RMC component may allow local elevation of privilege
5.5
CVE-2022-37939
A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 servers
5.5
CVE-2019-11998
HPE Superdome Flex Server is vulnerable to multiple remote vulnerabilities via improper input validation of administrator commands