Hpe Compute Scale Up Server 3200 Platform
Monthly
OS command injection on the Remote Management Controller (RMC) of HPE Compute Scale-up Server 3200/3250 and Superdome Flex / Flex 280 platforms allows an attacker who already holds high-privilege credentials on the RMC to run arbitrary operating system commands on the controller. The flaw is rated CVSS 7.2 (High) with a vector of AV:N/AC:L/PR:H/UI:N, so exploitation is remote and low-complexity once the privileged foothold exists - the high-privilege requirement is the principal limiting factor and rules out unauthenticated attacks. No public exploit code or confirmed active exploitation is identified in the available data, though the sensitive nature of the RMC as a system-management plane makes exposure to untrusted networks a significant risk multiplier.
Improper input validation in the Rack Management Controller (RMC) on HPE Compute Scale-up Server 3200/3250 platforms and Superdome Flex servers allows a network-reachable, authenticated low-privilege user to list and modify files on the RMC filesystem (CVSS 3.1: 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Impact is confined to the management-controller layer - exposure of RMC file contents plus limited integrity damage - rather than code execution or loss of availability on the managed compute partitions. No public exploit code was identified at time of analysis, and practical risk is further reduced because these RMC interfaces are normally deployed on segregated administrative networks.
OS command injection on the Remote Management Controller (RMC) of HPE Compute Scale-up Server 3200/3250 and Superdome Flex / Flex 280 platforms allows an attacker who already holds high-privilege credentials on the RMC to run arbitrary operating system commands on the controller. The flaw is rated CVSS 7.2 (High) with a vector of AV:N/AC:L/PR:H/UI:N, so exploitation is remote and low-complexity once the privileged foothold exists - the high-privilege requirement is the principal limiting factor and rules out unauthenticated attacks. No public exploit code or confirmed active exploitation is identified in the available data, though the sensitive nature of the RMC as a system-management plane makes exposure to untrusted networks a significant risk multiplier.
Improper input validation in the Rack Management Controller (RMC) on HPE Compute Scale-up Server 3200/3250 platforms and Superdome Flex servers allows a network-reachable, authenticated low-privilege user to list and modify files on the RMC filesystem (CVSS 3.1: 4.3, AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Impact is confined to the management-controller layer - exposure of RMC file contents plus limited integrity damage - rather than code execution or loss of availability on the managed compute partitions. No public exploit code was identified at time of analysis, and practical risk is further reduced because these RMC interfaces are normally deployed on segregated administrative networks.