CVE-2020-7207
A local elevation of privilege using physical access security vulnerability was found in HPE...
A local elevation of privilege using physical access security vulnerability was found in HPE Proliant Gen10 Servers using Intel Innovation Engine (IE). This attack requires a physical attack to the server motherboard. To mitigate this issue, ensure your server is always physically secured. HPE will not address this issue in the impacted Gen 10 servers listed. HPE recommends using appropriate physical security methods as a compensating control to disallow an attacker from having physical access to the server main circuit board.
Attack profile
How easy it is to exploit
- Attack vector
- Physical
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A local elevation of privilege using physical access security vulnerability was found in HPE Proliant Gen10 Servers using Intel Innovation Engine (IE). This attack requires a physical attack to the server motherboard. To mitigate this issue, ensure your server is always physically secured. HPE will not address this issue in the impacted Gen 10 servers listed. HPE recommends using appropriate physical security methods as a compensating control to disallow an attacker from having physical access to the server main circuit board.
- Record
CVE-2020-7207- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
A local elevation of privilege using physical access security vulnerability was found in HPE Proliant Gen10 Servers using Intel Innovation Engine (IE). This attack requires a physical attack to the server motherboard. To mitigate this issue, ensure your server is always physically secured. HPE will not address this issue in the impacted Gen 10 servers listed. HPE recommends using appropriate physical security methods as a compensating control to disallow an attacker from having physical access to the server main circuit board.
- Record
CVE-2020-7207- Updated
- 2026-11-02
EUVDEUVD-2020-28341 No score
A local elevation of privilege using physical access security vulnerability was found in HPE Proliant Gen10 Servers using Intel Innovation Engine (IE). This attack requires a physical attack to the server motherboard. To mitigate this issue, ensure your server is always physically secured. HPE will not address this issue in the impacted Gen 10 servers listed. HPE recommends using appropriate physical security methods as a compensating control to disallow an attacker from having physical access to the server main circuit board.
- Record
EUVD-2020-28341- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6f5c-w4pr-3xr4 No score
A local elevation of privilege using physical access security vulnerability was found in HPE...
A local elevation of privilege using physical access security vulnerability was found in HPE Proliant Gen10 Servers using Intel Innovation Engine (IE). This attack requires a physical attack to the server motherboard. To mitigate this issue, ensure your server is always physically secured. HPE will not address this issue in the impacted Gen 10 servers listed. HPE recommends using appropriate physical security methods as a compensating control to disallow an attacker from having physical access to the server main circuit board.
- Record
GHSA-6f5c-w4pr-3xr4- Weakness
- CWE-269
- Updated
- 2026-11-02
Affected products
- hp apollo 2000 firmware
- hp apollo 4200 gen10 firmware
- hp apollo 4500 firmware
- hp proliant bl460c gen10 firmware
- hp proliant dl120 gen10 firmware
- hp proliant dl160 gen10 firmware
- hp proliant dl180 gen10 firmware
- hp proliant dl360 gen10 firmware
- hp proliant dl380 gen10 firmware
- hp proliant dl560 gen10 firmware
- hp proliant dl580 gen10 firmware
- hp proliant e910 firmware
Show 9 moreShow less
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-7207 is a medium vulnerability (CVSS 6.8) in Hp Apollo 2000 Firmware, published November 5, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. No source names a fixed version.