vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2020-7207

MEDIUM
6.8
CVSS Score
Published: November 5, 2020 at 08:14 PM UTC
Updated: June 17, 2026 at 03:24 AM UTC
58 products affected across 2 vendorsApollo 2000 FirmwareProliant E910 FirmwareApollo 4200 GEN10 Firmware

Using HPE ProLiant BL460c Gen10 Server Blade; HPE ProLiant DL360 Gen10 Server; HPE ProLiant DL380 Gen10 Server; HPE ProLiant DL560 Gen10 Server; HPE ProLiant DL580 Gen10 Server; HPE ProLiant ML110 Gen10 Server; HPE ProLiant XL230k Gen10 Server; HPE Synergy 480 Gen10 Compute Module; HPE Synergy 660 Gen10 Compute Module; HPE ProLiant DL180 Gen10 Server; HPE ProLiant DL160 Gen10 Server; HPE ProLiant DL120 Gen10 Server; HPE ProLiant XL190r Gen10 Server; HPE ProLiant ML350 Gen10 Server; HPE ProLiant XL170r Gen10 Server; HPE Apollo 2000 System; HPE Apollo 4500 System; HPE ProLiant XL270d Gen10 Server; HPE Apollo 4200 Gen10 Server; HPE ProLiant e910 Server Blade; HPE ProLiant XL450 Gen10 Server; HPE ProLiant XL230k Gen10 Server - bad oid by N/A?

Get instant alerts when new vulnerabilities affect HPE ProLiant BL460c Gen10 Server Blade; HPE ProLiant DL360 Gen10 Server; HPE ProLiant DL380 Gen10 Server; HPE ProLiant DL560 Gen10 Server; HPE ProLiant DL580 Gen10 Server; HPE ProLiant ML110 Gen10 Server; HPE ProLiant XL230k Gen10 Server; HPE Synergy 480 Gen10 Compute Module; HPE Synergy 660 Gen10 Compute Module; HPE ProLiant DL180 Gen10 Server; HPE ProLiant DL160 Gen10 Server; HPE ProLiant DL120 Gen10 Server; HPE ProLiant XL190r Gen10 Server; HPE ProLiant ML350 Gen10 Server; HPE ProLiant XL170r Gen10 Server; HPE Apollo 2000 System; HPE Apollo 4500 System; HPE ProLiant XL270d Gen10 Server; HPE Apollo 4200 Gen10 Server; HPE ProLiant e910 Server Blade; HPE ProLiant XL450 Gen10 Server; HPE ProLiant XL230k Gen10 Server - bad oid - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
MEDIUM6.8
Exploit prediction
EPSS 0.5%

Description

A local elevation of privilege using physical access security vulnerability was found in HPE Proliant Gen10 Servers using Intel Innovation Engine (IE). This attack requires a physical attack to the server motherboard. To mitigate this issue, ensure your server is always physically secured. HPE will not address this issue in the impacted Gen 10 servers listed. HPE recommends using appropriate physical security methods as a compensating control to disallow an attacker from having physical access to the server main circuit board.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Apollo 2000 Firmware· HP
95%
All versions
hp-apollo-2000 (same device)
Apollo 4200 GEN10 Firmware· HP
95%
All versions
hp-apollo-4200-gen10 (same device)
Apollo 4500 Firmware· HP
95%
All versions
hp-apollo-4500 (same device)
Proliant BL460C GEN10 Firmware· HP
95%
All versions
hp-proliant-bl460c-gen10 (same device)
Proliant DL120 GEN10 Firmware· HP
95%
All versions
hp-proliant-dl120-gen10 (same device)
Proliant DL160 GEN10 Firmware· HP
95%
All versions
hp-proliant-dl160-gen10 (same device)
Proliant DL180 GEN10 Firmware· HP
95%
All versions
hp-proliant-dl180-gen10 (same device)
Proliant DL360 GEN10 Firmware· HP
95%
All versions
hp-proliant-dl360-gen10 (same device)
Proliant DL380 GEN10 Firmware· HP
95%
All versions
hp-proliant-dl380-gen10 (same device)
Proliant DL560 GEN10 Firmware· HP
95%
All versions
hp-proliant-dl560-gen10 (same device)

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (1)

x_refsource_MISCVendor Advisory
Source: [email protected]
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04002en_us

CVSS

6.8MEDIUM[email protected]
Attack Vector
PHYSICAL
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Vector?

Quick Info

StatusMODIFIED
CWE
NVD-CWE-noinfo

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card