dbcve.org
Superdome Flex 280 FirmwareOperating system · Hpe

CVE-2022-37933

HIGH · 7.8 CVSS v3.1 Published 2023-01-05
Fix available
A fix is available. Upgrade to 1.40.60 / 3.60.50 or later.
See remediation →
80/100
Remediation priority · High
Zero-click

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 servers. The vulnerability could be exploited to allow local unauthorized data injection. HPE has made the following software updates to resolve the vulnerability in HPE Superdome Flex firmware 3.60.50 and below and Superdome Flex 280 servers firmware 1.40.60 and below.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · moderate confidence

A local data injection vulnerability exists in HPE Superdome Flex (firmware 3.60.50 and below) and Superdome Flex 280 (firmware 1.40.60 and below) servers. An attacker with local access could exploit this to inject unauthorized data, likely through improper input validation or privilege handling in the firmware management layer.

MitigationUpdate HPE Superdome Flex firmware to a version above 3.60.50 and Superdome Flex 280 firmware to a version above 1.40.60. Since this is a local attack vector, restrict physical access and limit local shell privileges as a compensating control until firmware updates can be applied.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Superdome Flex 280 FirmwareOperating system
Affected:< 1.40.60
Superdome Flex FirmwareOperating system
Affected:< 3.60.50

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify HPE server model
    Check the physical server label or use HPE system management interfaces (iLO, HPE OneView, or SUM) to confirm the exact model: Superdome Flex or Superdome Flex 280
    Affected if The server is an HPE Superdome Flex or Superdome Flex 280 system
  2. Retrieve current firmware version
    Access the server through HPE iLO web interface, HPE OneView, or run the 'hpsum' (HPE Smart Update Manager) command locally to query the installed firmware version. The version is typically displayed in the firmware inventory or system health summary
    Affected if Unable to retrieve firmware version (may indicate limited access rather than vulnerability)
  3. Compare firmware version against affected ranges
    For Superdome Flex: verify if firmware version is less than 3.60.50. For Superdome Flex 280: verify if firmware version is less than 1.40.60. Compare the retrieved version string numerically
    Affected if Firmware version is below 3.60.50 on Superdome Flex, or below 1.40.60 on Superdome Flex 280
  4. Assess local access exposure
    Review physical security controls and local shell access policies. Determine if untrusted individuals have physical access to the server or if local user accounts with firmware management privileges exist
    Affected if Local access is not properly restricted (this is the attack vector prerequisite, not proof of exploitation)

The environment is affected if the server is an HPE Superdome Flex with firmware below 3.60.50 or a Superdome Flex 280 with firmware below 1.40.60, and untrusted local access is possible.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 1.40.60 / 3.60.50 or later
Fixed in 1.40.603.60.50
Interim mitigation

Update HPE Superdome Flex firmware to a version above 3.60.50 and Superdome Flex 280 firmware to a version above 1.40.60. Since this is a local attack vector, restrict physical access and limit local shell privileges as a compensating control until firmware updates can be applied.

Recommended fix High confidence

Superdome Flex 280: firmware >= 1.40.60; Superdome Flex: firmware >= 3.60.50

  1. Identify the exact model (Superdome Flex or Superdome Flex 280) and current firmware version of the affected server
  2. Navigate to HPE support website (support.hpe.com) and locate the firmware download section for your specific server model
  3. Download the firmware update: for Superdome Flex 280 download version 1.40.60 or later; for Superdome Flex download version 3.60.50 or later
  4. Follow HPE's standard firmware update procedure for Superdome Flex servers, typically using the HPE iLO or HPE SUM firmware update tool
  5. Apply the firmware update following HPE's documented upgrade process
  6. After reboot, verify the firmware version has been successfully updated to the fixed release
Caveat Firmware updates typically require server downtime; ensure proper maintenance windows and follow HPE backup/procedure documentation

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Superdome Flex 280 Firmware Scoped from the published advisory
  • Consultation4.0 h
  • Implementation6.0 h
  • Testing3.0 h
  • Review / QA2.0 h
15.0 hours of engineering $2,690
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $4,304.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2022-37933 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2022-37933 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data