Security readout for executives and security teams
Plain-English summary
This flaw affects HPE Intelligent Provisioning for Gen9 servers and can let a local, already low-privileged user escalate privileges. It is not a remote internet attack from the evidence provided, but successful exploitation could compromise confidentiality, integrity, and availability on affected systems. No cited source shows known active exploitation.
Executive priority
Prioritize remediation for environments with HPE Gen9 servers, especially where local access is shared, outsourced, or weakly controlled. Treat as high impact but not currently evidenced as remotely exploitable or actively exploited.
Technical view
CVE-2023-30906 is a local privilege escalation issue in HPE Intelligent Provisioning for Gen9, listed for v2.87 or later. CVSS 3.1 is 7.5 with local access, high complexity, low privileges, user interaction, changed scope, and high CIA impact. No CWE, technical root cause, or exploit details are provided in the source bundle.
Likely exposure
Exposure is most likely in environments still operating HPE Gen9 servers using HPE Intelligent Provisioning v2.87 or later. Internet-facing exposure is not indicated because the CVSS attack vector is local.
Exploitation context
The CVE is not listed as CISA KEV in the provided data, and no cited source claims active exploitation. The available evidence supports local exploitation only, requiring prior low privileges and user interaction under high-complexity conditions.
Researcher notes
The source bundle is sparse: no CWE, root cause, patch identifier, or exploit narrative is included. Validate exposure against HPE advisory hpesbhf04486en_us before drawing conclusions about exact affected builds or fixes.
Mitigation direction
- Review the HPE advisory for affected-version and remediation details.
- Inventory HPE Gen9 systems using Intelligent Provisioning.
- Confirm whether Intelligent Provisioning is v2.87 or later.
- Restrict local, console, and administrative access to affected servers.
- Monitor HPE support channels for corrected guidance or updates.
Validation and detection
- Identify all HPE Gen9 servers in asset inventory.
- Record installed HPE Intelligent Provisioning versions.
- Compare versions against the HPE advisory and CVE record.
- Review local access controls for affected systems.
- Check security logs for suspicious local privilege changes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2023-30906 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H0.86Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.5HighVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H
Source materials
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.