CVE-2022-28620

Published: Jun 24, 2022Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

A remote authentication bypass vulnerability was discovered in HPE Cray Legacy Shasta System Solutions; HPE Slingshot; and HPE Cray EX supercomputers versions: Prior to node controller firmware associated with HPE Cray EX liquid cooled blades, and all versions of chassis controller firmware associated with HPE Cray EX liquid cooled cabinets prior to 1.6.27/1.5.33/1.4.27; All Slingshot versions prior to 1.7.2; All versions of node controller firmware associated with HPE Cray EX liquid cooled blades, and all versions of chassis controller firmware associated with HPE Cray EX liquid cooled cabinets prior to 1.6.27/1.5.33/1.4.27. HPE has provided a software update to resolve this vulnerability in HPE Cray Legacy Shasta System Solutions, HPE Slingshot, and HPE Cray EX Supercomputers.

Affected (13)

Products: Hpe: Slingshot Firmware, Cray Ex Supercomputers Firmware, Cray Sh Supercomputer Air Cooled Base System Code Firmware, Cray Sh Supercomputer Liquid Cooled Base System Code Firmware, Cray Sh Supercomputer Liquid Cooled Tds Base System Code Firmware

Hpe

5 products

Slingshot Firmware

Cray Ex Supercomputers Firmware

Cray Sh Supercomputer Air Cooled Base System Code Firmware

Cray Sh Supercomputer Liquid Cooled Base System Code Firmware

Cray Sh Supercomputer Liquid Cooled Tds Base System Code Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hpe Slingshot Firmware	Before 1.7.2

Running on/with	Platform Versions
Hpe Slingshot	All versions

Configuration B

3 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hpe Cray Ex Supercomputers Firmware	Version 1.4.27
Hpe Cray Ex Supercomputers Firmware	Version 1.5.33
Hpe Cray Ex Supercomputers Firmware	Version 1.6.27

Running on/with	Platform Versions
Hpe Cray Ex Supercomputers	All versions

Configuration C

3 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hpe Cray Sh Supercomputer Air Cooled Base System Code Firmware	Version 1.4.27
Hpe Cray Sh Supercomputer Air Cooled Base System Code Firmware	Version 1.5.33
Hpe Cray Sh Supercomputer Air Cooled Base System Code Firmware	Version 1.6.27

Running on/with	Platform Versions
Hpe Cray Sh Supercomputer Air Cooled Base System Code	All versions

Configuration D

3 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hpe Cray Sh Supercomputer Liquid Cooled Base System Code Firmware	Version 1.4.27
Hpe Cray Sh Supercomputer Liquid Cooled Base System Code Firmware	Version 1.5.33
Hpe Cray Sh Supercomputer Liquid Cooled Base System Code Firmware	Version 1.6.27

Running on/with	Platform Versions
Hpe Cray Sh Supercomputer Liquid Cooled Base System Code	All versions

Configuration E

3 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Hpe Cray Sh Supercomputer Liquid Cooled Tds Base System Code Firmware	Version 1.4.27
Hpe Cray Sh Supercomputer Liquid Cooled Tds Base System Code Firmware	Version 1.5.33
Hpe Cray Sh Supercomputer Liquid Cooled Tds Base System Code Firmware	Version 1.6.27

Running on/with	Platform Versions
Hpe Cray Sh Supercomputer Liquid Cooled Tds Base System Code	All versions

References (2)

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbcr04284en_us

Source: security-alert@hpe.com

Vendor Advisory

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbcr04284en_us

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.