CVE-2017-12542
| Reporter | Title | Published | Views | Family All 30 |
|---|---|---|---|---|
 | HPE iLO4 < 2.53 - Add New Administrator User Exploit | 8 Feb 201800:00 | – | zdt |
 | CVE-2017-12542 | 15 Feb 201800:00 | – | attackerkb |
 | The vulnerability of the HPE Integrated Lights-out 4 (iLO 4) server management tool lies in its authentication procedures’ flaws, which allow attackers to bypass the authentication process and execute arbitrary code. | 7 Jun 201800:00 | – | bdu_fstec |
 | CVE-2017-12542 | 27 Apr 201823:53 | – | circl |
 | HP Integrated Lights-out 4 Remote Code Execution Vulnerability | 25 Aug 201700:00 | – | cnvd |
 | HPE Integrated Lights-Out 4 Authentication Bypass (CVE-2017-12542) | 8 Jul 201800:00 | – | checkpoint_advisories |
| HPE Lights-Out Authentication Bypass (CVE-2017-12542) | 22 Nov 201800:00 | – | checkpoint_advisories |
 | CVE-2017-12542 | 15 Feb 201822:00 | – | cvelist |
 | HPE iLO 4 < 2.53 - Add New Administrator User | 5 Feb 201800:00 | – | exploitdb |
 | HPE iLO 4 2.53 - Add New Administrator User | 5 Feb 201800:00 | – | exploitpack |
10
Node
AND
[
{
"product": "Integrated Lights-out 4 (iLO 4)",
"vendor": "Hewlett Packard Enterprise",
"versions": [
{
"status": "affected",
"version": "Prior to 2.53"
}
]
}
]| Source | Link |
|---|---|
| securitytracker | www.securitytracker.com/id/1039222 |
| support | www.support.hpe.com/hpsc/doc/public/display |
| securityfocus | www.securityfocus.com/bid/100467 |
| exploit-db | www.exploit-db.com/exploits/44005/ |
| Parameter | Position | Path | Description | CWE |
|---|---|---|---|---|
| Connection | header | rest/v1/AccountService/Accounts | Authentication bypass attempt via crafted header as shown in PoC | CWE-306 |
| UserName | request body | rest/v1/AccountService/Accounts | Exploitation attempt via JSON body to create/modify accounts (RCE/auth bypass potential) as demonstrated in PoC | CWE-306 |
| Password | request body | rest/v1/AccountService/Accounts | Exploitation attempt via JSON body to create/modify accounts (RCE/auth bypass potential) as demonstrated in PoC | CWE-306 |
| Oem | request body | rest/v1/AccountService/Accounts | Exploitation attempt via JSON body to create/modify accounts (RCE/auth bypass potential) as demonstrated in PoC | CWE-306 |
| item | query param | xmldata?item=ALL | Go scanner endpoint used to identify vulnerable iLO instances and fetch firmware type/version | CWE-306 |
Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
17 Jun 2026 01:03Current
9.5High risk
Vulners AI Score9.5
CVSS 310
CVSS 210
EPSS0.99294