CVE-2022-37928: HPE HF20 Firmware

Medium severity, CVSS 6.5. EPSS: 0.3% chance of exploitation in the next 30 days.

Insufficient Verification of Data Authenticity vulnerability in Hewlett Packard Enterprise HPE Nimble Storage Hybrid Flash Arrays and Nimble Storage Secondary Flash Arrays.

Affected products

• HPE HF20 Firmware: before 5.2.1.900 (fixed in 5.2.1.900); version 5.3.0.0 only
• HPE HF20C Firmware: before 5.2.1.900 (fixed in 5.2.1.900); version 5.3.0.0 only
• HPE HF20H Firmware: before 5.2.1.900 (fixed in 5.2.1.900); version 5.3.0.0 only
• HPE HF40 Firmware: before 5.2.1.900 (fixed in 5.2.1.900); version 5.3.0.0 only
• HPE HF40C Firmware: before 5.2.1.900 (fixed in 5.2.1.900); version 5.3.0.0 only
• HPE HF60 Firmware: before 5.2.1.900 (fixed in 5.2.1.900); version 5.3.0.0 only
• HPE HF60C Firmware: before 5.2.1.900 (fixed in 5.2.1.900); version 5.3.0.0 only
• HPE SF100 Firmware: before 5.2.1.900 (fixed in 5.2.1.900); version 5.3.0.0 only
• HPE SF300 Firmware: before 5.2.1.900 (fixed in 5.2.1.900); version 5.3.0.0 only

Published 2022-12-12. Last modified 2026-06-17.