How severe is CVE-2020-7135?

CVE-2020-7135 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2020-7135 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (40th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-7135?

CVE-2020-7135 primarily affects Hp Service Pack For Proliant. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2020-7135?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2020-7135 published?

CVE-2020-7135 was published on 2020-04-27 and last updated on 2026-06-17.

CVE-2020-7135

CVE-2020-7135 is a high-severity vulnerability in Hp Service Pack For Proliant with a CVSS 3.x base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: High (CVSS 3.x base score 7.8)
CVSS v2: 4.6
EPSS exploit prediction: 1% (40th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Hp Service Pack For Proliant
Published: 2020-04-27
Last modified: 2026-06-17

Description

A potential security vulnerability has been identified in the disk drive firmware installers named Supplemental Update / Online ROM Flash Component on HPE servers running Linux. The vulnerable software is included in the HPE Service Pack for ProLiant (SPP) releases 2018.06.0, 2018.09.0, and 2018.11.0. The vulnerable software is the Supplemental Update / Online ROM Flash Component for Linux (x64) software. The installer in this software component could be locally exploited to execute arbitrary code. Drive Models can be found in the Vulnerability Resolution field of the security bulletin. The 2019_03 SPP and Supplemental update / Online ROM Flash Component for Linux (x64) after 2019.03.0 has fixed this issue.

Frequently asked questions

What is CVE-2020-7135?: A potential security vulnerability has been identified in the disk drive firmware installers named Supplemental Update / Online ROM Flash Component on HPE servers running Linux. The vulnerable software is included in the HPE Service Pack for ProLiant (SPP) releases 2018.06.0, 2018.09.0, and 2018.11.0. The vulnerable software is the Supplemental Update / Online ROM Flash Component for Linux (x64) software. The installer in this software component could be locally exploited to execute arbitrary code. Drive Models can be found in the Vulnerability Resolution field of the security bulletin. The 2019_03 SPP and Supplemental update / Online ROM Flash Component for Linux (x64) after 2019.03.0 has fixed this issue.
How severe is CVE-2020-7135?: CVE-2020-7135 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2020-7135 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (40th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-7135?: CVE-2020-7135 primarily affects Hp Service Pack For Proliant. In total, 4 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2020-7135?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2020-7135 published?: CVE-2020-7135 was published on 2020-04-27 and last updated on 2026-06-17.

References

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03945en_us

Affected products (4)

cpe:2.3:a:hp:service_pack_for_proliant:2018.06.0:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_pack_for_proliant:2018.09.0:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_pack_for_proliant:2018.11.0:*:*:*:*:*:*:*
cpe:2.3:a:hp:service_pack_for_proliant:2019.03.0:*:*:*:*:*:*:*

More vulnerabilities in Hp Service Pack For Proliant

CVE-2018-7118 — High (CVSS 7.8): A local access restriction bypass vulnerability was identified in HPE Service Pack for ProLiant (SPP) Bundled Software…

All CVEs affecting Hp Service Pack For Proliant →