CVE-2018-7120 : A security vulnerability in the HPE Virtual Connect SE 16Gb Fibre Channel Module

A security vulnerability in the HPE Virtual Connect SE 16Gb Fibre Channel Module for HPE Synergy running firmware 5.00.50, which is part of the HPE Synergy Custom SPP 2018.11.20190205, could allow local or remote unauthorized elevation of privilege.

Published 2019-05-10 19:29:04

Updated 2019-10-03 00:03:26

Source Hewlett Packard Enterprise (HPE)

View at NVD, CVE.org

Vulnerability category: Gain privilege

Products affected by CVE-2018-7120

HP » Synergy Firmware » Version: 5.00.50
cpe:2.3:o:hp:synergy_firmware:5.00.50:*:*:*:*:*:*:*
Matching versions
When used together with: HP » Synergy » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2018-7120

EPSS FAQ

0.19%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 56 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-7120

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.8	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2018-7120

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03916en_us

HPESBHF03916 rev.1 - HPE Virtual Connect SE 16Gb Fibre Channel Module for Synergy, Local or Remote Unauthorized Elevation of Privilege
Vendor Advisory

Jump to

Vulnerability Details : CVE-2018-7120

Products affected by CVE-2018-7120

Exploit prediction scoring system (EPSS) score for CVE-2018-7120

CVSS scores for CVE-2018-7120

References for CVE-2018-7120