Vulnerability in HPE Cray Ex Supercomputers
CVE-2022-28620
A remote authentication bypass vulnerability was discovered in HPE Cray Legacy Shasta System Solutions; HPE Slingshot; and HPE Cray EX supercomputers versions: Prior to node controller firmware associated with HPE Cray EX liquid cooled blades, and all versions of chassis controller firmware associated with HPE Cray EX liquid cooled cabinets prior to 1.6.27/1.5.33/1.4.27; All Slingshot versions prior to 1.7.2; All versions of node controller firmware associated with HPE Cray EX liquid cooled blades, and all versions of chassis controller firmware associated with HPE Cray EX liquid cooled cabinets prior to 1.6.27/1.5.33/1.4.27. HPE has provided a software update to resolve this vulnerability in HPE Cray Legacy Shasta System Solutions, HPE Slingshot, and HPE Cray EX Supercomputers.
EPSS: 0.015 (71.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Hpe Cray_ex_supercomputers
- Hpe Cray_ex_supercomputers_firmware — versions 1.4.27, 1.5.33, 1.6.27
- Hpe Cray_sh_supercomputer_air_cooled_base_system_code
- Hpe Cray_sh_supercomputer_air_cooled_base_system_code_firmware — versions 1.4.27, 1.5.33, 1.6.27
- Hpe Cray_sh_supercomputer_liquid_cooled_base_system_code
- Hpe Cray_sh_supercomputer_liquid_cooled_base_system_code_firmware — versions 1.4.27, 1.5.33, 1.6.27
- Hpe Cray_sh_supercomputer_liquid_cooled_tds_base_system_code
- Hpe Cray_sh_supercomputer_liquid_cooled_tds_base_system_code_firmware — versions 1.4.27, 1.5.33, 1.6.27
- Hpe Slingshot
- Hpe Slingshot_firmware
References
- security-alert@hpe.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2022-28620?
- CVE-2022-28620 is a critical-severity vulnerability in HPE Cray Ex Supercomputers. CVSS score: 9.8/10. Published 2022-06-24.
- How severe is CVE-2022-28620?
- Critical severity. CVSS v3 base score is 9.8 out of 10.