HPE Smart Update Manager vulnerabilities

4 CVEs affecting HPE Smart Update Manager, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-7136, published 2020-04-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-7136, published 2020-04-30. Critical severity, CVSS 9.8. EPSS: 80.9% chance of exploitation in the next 30 days. A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access. Hewlett Packard Enterprise has provided a software update to resolve this…
CVE-2019-11988, published 2019-06-05. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. A Remote Unauthorized Access vulnerability was identified in HPE Smart Update Manager (SUM) earlier than version 8.3.5.
CVE-2014-2608, published 2014-12-10. High severity, CVSS 7.2. EPSS: 0.4% chance of exploitation in the next 30 days. Unspecified vulnerability in HP Smart Update Manager 6.x before 6.4.1 on Windows, and 6.2.x through 6.4.x before 6.4.1 on Linux, allows local users to obtain sensitive information, and consequently…
CVE-2019-11987, published 2019-06-05. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. A security vulnerability in HPE Smart Update Manager (SUM) prior to v8.4 could allow local unauthorized elevation of privilege.