The vulnerability permits a remote attacker to list and modify files within the Remote Management Controller (RMC) filesystem of HPE Compute Scale‑up Server 3200 and 3250 platforms and Superdome Flex servers. This flaw is rooted in improper input validation (CWE‑20) and allows the attacker to alter configuration files or place malicious code, potentially leading to unauthorized control or data exfiltration. The impact is limited to the RMC domain, but because the RMC orchestrates many management functions, compromised files could affect overall server operation, confidentiality, and integrity.

Affected products include HPE Compute Scale‑up Server 3200 platform, HPE Compute Scale‑up Server 3250 platform, and HPE Superdome Flex server. No specific versions are listed in the advisory, so all current releases deployed on these platforms should be regarded as potentially vulnerable until a vendor‑issued update is applied.

The CVSS score of 4.3 indicates a moderate severity, while the EPSS score is not available, making the current exploit likelihood unclear. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote, via the RMC interface, which is typically exposed over a network port. Because the flaw allows read and write access to RMC files, a successful exploit could give an adversary persistent influence over server behavior; however, the lack of an elevated CVSS score suggests that additional constraints or protections may already mitigate widespread exploitation.