CVE-2018-7112
The HPE-provided Windows firmware installer for certain Gen9, Gen8, G7,and G6 HPE servers allows local disclosure of privileged information.
Does this matter?
Lower severity and a low EPSS score (0.67%). Track it; it rarely justifies an emergency change on its own.
Description
The HPE-provided Windows firmware installer for certain Gen9, Gen8, G7,and G6 HPE servers allows local disclosure of privileged information. This issue was resolved in previously provided firmware updates as follows. The HPE Windows firmware installer was updated in the system ROM updates which also addressed the original Spectre/Meltdown set of vulnerabilities. At that time, the Windows firmware installer was also updated in the versions of HPE Integrated Lights-Out 2, 3, and 4 (iLO 2, 3, and 4) listed in the security bulletin. The updated HPE Windows firmware installer was released in the system ROM and HPE Integrated Lights-Out (iLO) releases documented in earlier HPE Security Bulletins: HPESBHF03805, HPESBHF03835, HPESBHF03831. Windows-based systems that have already been updated to the system ROM or iLO versions described in these security bulletins require no further action.
- CVSS 3.0
- 5.5 MEDIUMCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.67% probability · 50th percentile
- CISA KEV
- Not listed
- Affected
- hp/integrated lights-out 2 firmware · hp/integrated lights-out 3 firmware · hp/integrated lights-out 4 firmware · hp/proliant xl750f gen9 server firmware · hp/proliant xl740f gen9 server firmware · hp/proliant xl730f gen9 server firmware · hp/proliant xl450 gen9 server firmware · hp/proliant xl270d gen9 server firmware · hp/proliant xl270d gen9 accelerator tray firmware · hp/proliant xl260a gen9 server firmware · hp/proliant xl250a gen9 server firmware · hp/proliant xl230a gen9 server firmware · hp/proliant xl190r gen9 server firmware · hp/proliant xl170r gen9 server firmware · hp/proliant dl560 gen9 server firmware · hp/proliant dl380 gen9 server firmware · hp/proliant dl360 gen9 server firmware · hp/proliant dl180 gen9 server firmware · hp/proliant dl160 gen9 server firmware · hp/proliant dl120 gen9 server firmware · +40 more
- Source
- security-alert@hpe.com
References
- http://www.securitytracker.com/id/1041984Third Party Advisory, VDB Entry
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03805en_usNot Applicable, Vendor Advisory
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03831en_usNot Applicable, Vendor Advisory
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03835en_usNot Applicable, Vendor Advisory
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03869en_usVendor Advisory
- http://www.securitytracker.com/id/1041984Third Party Advisory, VDB Entry
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03805en_usNot Applicable, Vendor Advisory
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03831en_usNot Applicable, Vendor Advisory
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03835en_usNot Applicable, Vendor Advisory
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03869en_usVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.