A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 servers.

published 2023-01-03 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-40540

cvss: 7.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 20%
public exploits: 0; none known

A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 servers. The vulnerability could be exploited to allow local unauthorized data injection. HPE has made the following software updates to resolve the vulnerability in HPE Superdome Flex firmware 3.60.50 and below and Superdome Flex 280 servers firmware 1.40.60 and below.

Patch / fix

fixed in 2

hpe superdome_flex_280_firmware 1.40.60
hpe superdome_flex_firmware 3.60.50

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 18 mo ago (2025-04-10)

Exploit prediction

0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.3	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L
NVD	3.1	7.8	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

Hewlett Packard Enterprise (HPE) HPE Superdome Flex Server; HPE Superdome Flex 280 Server

Classification

Weakness

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component

References

support.hpe.com /hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04400en_us
vendor-advisory

Sources

CVE List CVE-2022-37933
NVD CVE-2022-37933

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary