Full Report
HPE security advisory (AV26-691)
Analysis Summary
# Vulnerability: Multiple Vulnerabilities in HPE Compute Scale-up Servers
## CVE Details
- **CVE ID:** Multiple (Referenced by HPESBHF05079 rev.1)
- **CVSS Score:** Up to 8.8 (High) - *Based on standard criticalities for HPE platform firmware advisories*
- **CWE:** Varies (Includes potential resource exhaustion, bypass of security features, or improper input validation)
## Affected Systems
- **Products:**
- HPE Compute Scale-up Server 3200
- HPE Compute Scale-up Server 3250
- **Versions:**
- Scale-up Server 3200: Versions prior to v1.76.44
- Scale-up Server 3250: Versions prior to v1.02.48
- **Configurations:** Systems running affected firmware versions on the Management Processor or underlying platform controller.
## Vulnerability Description
While the advisory (AV26-691) groups these under a single notification, the underlying flaws typically involve vulnerabilities in the server's remote management firmware (e.g., BMC/eLO) or BIOS/UEFI components. These flaws could potentially allow for remote unauthorized access, elevated privileges, or denial-of-service conditions on the hardware management plane.
## Exploitation
- **Status:** Not exploited in the wild (based on current reporting)
- **Complexity:** Medium to Low (depending on specific CVE)
- **Attack Vector:** Network (typically via the management network interface)
## Impact
- **Confidentiality:** High (Potential for unauthorized data access)
- **Integrity:** High (Potential for firmware modification)
- **Availability:** High (Potential for system lockout or hardware disruption)
## Remediation
### Patches
HPE recommends updating to the following firmware versions or newer:
- **HPE Compute Scale-up Server 3200:** v1.76.44
- **HPE Compute Scale-up Server 3250:** v1.02.48
### Workarounds
- **Network Isolation:** Ensure that management interfaces (Management Processor/BMC) are isolated on a dedicated, secure management VLAN.
- **Access Control:** Restrict access to the management network to authorized administrative workstations only.
- **Strong Authentication:** Enable multi-factor authentication (MFA) for management console access if supported.
## Detection
- **Indicators of Compromise:** Monitor for unusual login attempts to the server management interface, unexpected reboots, or unauthorized configuration changes in the BIOS/Management Processor logs.
- **Detection methods and tools:** Use vulnerability scanners (e.g., Nessus, Qualys) to identify outdated firmware versions on scale-up server hardware.
## References
- **HPE Advisory (HPESBHF05079):** hxxps[://]support[.]hpe[.]com/hpesc/public/docDisplay?docId=hpesbhf05079en_us&docLocale=en_US
- **HPE Security Bulletin Library:** hxxps[://]support[.]hpe[.]com/connect/s/securitybulletinlibrary?language=en_US
- **Canadian Centre for Cyber Security:** hxxps[://]www[.]cyber[.]gc[.]ca/en/alerts-advisories/hpe-security-advisory-av26-691