Cyber Resilience

CVE-2022-28618

CriticalRCE

Published: 20 May 2022

Published
20 May 2022
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0217 84.7th percentile
Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-28618 is a critical-severity Command Injection (CWE-77) vulnerability in Hpe Nimbleos. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 15.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A command injection security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays and HPE Nimble Storage Secondary Flash Arrays that could allow an attacker to execute arbitrary commands on a Nimble…

more

appliance. HPE has made the following software updates to resolve the vulnerability in HPE Nimble Storage: 5.0.10.100 or later, 5.2.1.0 or later, 6.0.0.100 or later.

CWE(s)
CWE-77

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

hpe
nimbleos
≤ 5.0.10.100 · 5.1.0.0 — 5.2.1.500 · 5.3.0.0 — 6.0.0.100

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References