CVE-2017-12542

🗓️ 15 Feb 2018 22:00:00Reported by hpeType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 399 Views🌐 WEB

A code execution vulnerability in HPE iLO 4 v2.5

Reporter	Title	Published	Views	Family All 28
zdt	HPE iLO4 < 2.53 - Add New Administrator User Exploit	8 Feb 201800:00	–	zdt
ATTACKERKB	CVE-2017-12542	15 Feb 201800:00	–	attackerkb
BDU FSTEC	The vulnerability of the HPE Integrated Lights-out 4 (iLO 4) server management tool lies in its authentication procedures’ flaws, which allow attackers to bypass the authentication process and execute arbitrary code.	7 Jun 201800:00	–	bdu_fstec
Circl	CVE-2017-12542	27 Apr 201823:53	–	circl
CNVD	HP Integrated Lights-out 4 Remote Code Execution Vulnerability	25 Aug 201700:00	–	cnvd
Check Point Advisories	HPE Integrated Lights-Out 4 Authentication Bypass (CVE-2017-12542)	8 Jul 201800:00	–	checkpoint_advisories
Check Point Advisories	HPE Lights-Out Authentication Bypass (CVE-2017-12542)	22 Nov 201800:00	–	checkpoint_advisories
Cvelist	CVE-2017-12542	15 Feb 201822:00	–	cvelist
Exploit DB	HPE iLO 4 < 2.53 - Add New Administrator User	5 Feb 201800:00	–	exploitdb
exploitpack	HPE iLO 4 2.53 - Add New Administrator User	5 Feb 201800:00	–	exploitpack

NVD

Node

AND

hp integrated_lights-out_4_firmwareRange<2.53

hp integrated_lights-out_4Match-

[
  {
    "product": "Integrated Lights-out 4 (iLO 4)",
    "vendor": "Hewlett Packard Enterprise",
    "versions": [
      {
        "status": "affected",
        "version": "Prior to 2.53"
      }
    ]
  }
]

Source	Link
securitytracker	www.securitytracker.com/id/1039222
support	www.support.hpe.com/hpsc/doc/public/display
securityfocus	www.securityfocus.com/bid/100467
exploit-db	www.exploit-db.com/exploits/44005/

Parameter	Position	Path	Description	CWE
item	query param	/xmldata?item=ALL	Exposed iLO4 management interface page used to disclose firmware/server info; potential attack surface for authentication bypass where vulnerable versions expose sensitive data.	CWE-306
ALL	query param	/xmldata?item=ALL	Exposed iLO4 management interface page used to disclose firmware/server info; potential attack surface for authentication bypass where vulnerable versions expose sensitive data.	CWE-306
UserName	request body	/rest/v1/AccountService/Accounts	Authentication bypass and potential RCE via REST Accounts endpoint as described in CVE-2017-12542 exploit sample.	CWE-306
Password	request body	/rest/v1/AccountService/Accounts	Authentication bypass and potential RCE via REST Accounts endpoint as described in CVE-2017-12542 exploit sample.	CWE-306
Oem	request body	/rest/v1/AccountService/Accounts	Authentication bypass and potential RCE via REST Accounts endpoint as described in CVE-2017-12542 exploit sample.	CWE-306

17 Jun 2026 01:03Current

9.5High risk

Vulners AI Score9.5

CVSS 310

CVSS 210

EPSS0.99294

In Wild