CVE-2020-7197 json
SSMC3.7.0.0 is vulnerable to remote authentication bypass.
published 2020-10-26 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-28331
- cvss
- 9.8
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 2.2%
- EPSS 2.2% chance of exploitation in 30 days, percentile 82%
- public exploits
- 0
- none known
Summary
SSMC3.7.0.0 is vulnerable to remote authentication bypass. HPE StoreServ Management Console (SSMC) 3.7.0.0 is an off node multiarray manager web application and remains isolated from data on the managed arrays. HPE has provided an update to HPE StoreServ Management Console (SSMC) software 3.7.0.0* Upgrade to HPE 3PAR StoreServ Management Console 3.7.1.1 or later.
Patch / fix
- hp storeserv_management_console 3.7.1.1
Exploit prediction
2.18% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- n/a HPE 3PAR StoreServ Management and Core Software Media
Classification
- Weakness
-
- CWE-287 Improper Authentication
References
-
support.hpe.com
/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst04045en_us
patch, vendor-advisory
Sources
- CVE List CVE-2020-7197
- NVD CVE-2020-7197
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.