CVE-2022-37929: HPE HF20 Firmware

Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days.

Improper Privilege Management vulnerability in Hewlett Packard Enterprise Nimble Storage Hybrid Flash Arrays and Nimble Storage Secondary Flash Arrays.

Affected products

• HPE HF20 Firmware: before 5.2.1.900 (fixed in 5.2.1.900); version 5.3.0.0 only
• HPE HF20C Firmware: before 5.2.1.900 (fixed in 5.2.1.900); version 5.3.0.0 only
• HPE HF20H Firmware: before 5.2.1.900 (fixed in 5.2.1.900); version 5.3.0.0 only
• HPE HF40 Firmware: before 5.2.1.900 (fixed in 5.2.1.900); version 5.3.0.0 only
• HPE HF40C Firmware: before 5.2.1.900 (fixed in 5.2.1.900); version 5.3.0.0 only
• HPE HF60 Firmware: before 5.2.1.900 (fixed in 5.2.1.900); version 5.3.0.0 only
• HPE HF60C Firmware: before 5.2.1.900 (fixed in 5.2.1.900); version 5.3.0.0 only
• HPE SF100 Firmware: before 5.2.1.900 (fixed in 5.2.1.900); version 5.3.0.0 only
• HPE SF300 Firmware: before 5.2.1.900 (fixed in 5.2.1.900); version 5.3.0.0 only

Published 2022-12-12. Last modified 2026-06-17.