CVE-2021-25129

HIGH

HPE Cloudline CL3100/CL4100/CL5200/CL5800 Gen9/Gen10 BMC Firmware - Path Traversal via spx_restservice getvideodata_func

Title source: llm

Description

The Baseboard Management Controller(BMC) in HPE Cloudline CL5800 Gen9 Server; HPE Cloudline CL5200 Gen9 Server; HPE Cloudline CL4100 Gen10 Server; HPE Cloudline CL3100 Gen10 Server; HPE Cloudline CL5800 Gen10 Server BMC firmware has a local spx_restservice getvideodata_func function path traversal vulnerability.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_misc

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04073en_us

Scores

CVSS v3 7.8

EPSS 0.0012

EPSS Percentile 30.3%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-22

Status published

Products (7)

hpe/cloudline_cl3100_gen10_server_firmware 1.08.0.0

hpe/cloudline_cl3100_gen10_server_firmware 1.10.0.0

hpe/cloudline_cl4100_gen10_server_firmware 1.08.0.0

hpe/cloudline_cl4100_gen10_server_firmware 1.10.0.0

hpe/cloudline_cl5200_gen9_server_firmware 1.07.0.0

hpe/cloudline_cl5800_gen10_server_firmware 1.08.0.0

hpe/cloudline_cl5800_gen9_server_firmware 1.09.0.0

Published Jan 29, 2021

Tracked Since Feb 18, 2026