Cross site scripting

A remote cross site scripting vulnerability was identified in HPE iLO 3 all version prior to v1.88 and HPE iLO 4 all versions prior to v2.44...

Remote code execution

A remote code execution was identified in HPE Integrated Lights-Out 4 iLO 4 earlier than version v2.60 and HPE Integrated Lights-Out 5 iLO 5 earlier than version v1.30...

Design/Logic Flaw

A Unauthenticated Remote Denial of Service vulnerability was identified in HPE Integrated Lights-Out 3 iLO 3 version v1.88 only. The vulnerability is resolved in iLO3 v1.89 or subsequent versions...

CVE-2016-4406

A remote cross site scripting vulnerability was identified in HPE iLO 3 all version prior to v1.88 and HPE iLO 4 all versions prior to v2.44...

CVE-2016-4406

A remote cross site scripting vulnerability was identified in HPE iLO 3 all version prior to v1.88 and HPE iLO 4 all versions prior to v2.44...

CVE-2018-7078

CVE-2018-7078 describes a remote code execution impacting Hewlett Packard Enterprise’s HP Integrated Lights-Out (iLO) servers. The provided documents confirm exploitation could occur on iLO 4 versions earlier than 2.60 and iLO 5 versions earlier than 1.30, with a network-based attacker and no use...

CVE-2017-8987

CVE-2017-8987 affects HPE Integrated Lights-Out 3 (iLO 3). The vulnerability is an unauthenticated remote DoS in firmware version v1.88, with a fix in iLO3 v1.89 and newer. Exploitation can render the device unresponsive, impacting availability; no other impacts are indicated. Remediation: upgrad...

CVE-2018-7078

A remote code execution was identified in HPE Integrated Lights-Out 4 iLO 4 earlier than version v2.60 and HPE Integrated Lights-Out 5 iLO 5 earlier than version v1.30...

CVE-2016-4406

A remote cross site scripting vulnerability was identified in HPE iLO 3 all version prior to v1.88 and HPE iLO 4 all versions prior to v2.44...

CVE-2016-4406

HP iLO remote XSS (CVE-2016-4406) affects HP iLO 3 versions prior to 1.88 and iLO 4 versions prior to 2.44. The vulnerability arises from improper neutralization/validation of input during web page generation, enabling a remote, unauthenticated attacker to lure a user into clicking a crafted URL ...

CVE-2017-8987

A Unauthenticated Remote Denial of Service vulnerability was identified in HPE Integrated Lights-Out 3 iLO 3 version v1.88 only. The vulnerability is resolved in iLO3 v1.89 or subsequent versions...

CVE-2017-8979

Security vulnerabilities in the HPE Integrated Lights-Out 2 iLO 2 firmware could be exploited remotely to allow authentication bypass, code execution, and denial of service...

CVE-2017-12542

A authentication bypass and execution of code vulnerability in HPE Integrated Lights-out 4 iLO 4 version prior to 2.53 was found...

CVE-2017-12543

A remote disclosure of information vulnerability in Moonshot Remote Console Administrator Prior to 2.50, iLO4 prior to v2.53, iLO3 prior to v1.89 and iLO2 prior to v2.30 was found...

CVE-2017-12543

A remote disclosure of information vulnerability in Moonshot Remote Console Administrator Prior to 2.50, iLO4 prior to v2.53, iLO3 prior to v1.89 and iLO2 prior to v2.30 was found...

CVE-2017-12542

CVE-2017-12542 affects HPE Integrated Lights-Out 4 (iLO 4). The advisory/entries describe an authentication bypass and remote code execution vulnerability in iLO 4 versions prior to 2.53. Exploitation can grant unauthorized administrative access and potential execution of arbitrary code via the i...

CVE-2017-8979

CVE-2017-8979 affects HPE Integrated Lights-Out 2 (iLO 2) firmware. Multiple connected sources describe a remote vulnerability in iLO 2 that can be exploited to bypass authentication, execute arbitrary code, and cause denial of service. The Tenable/Nessus plugin references show an instance in iLO...

CVE-2017-12542

A authentication bypass and execution of code vulnerability in HPE Integrated Lights-out 4 iLO 4 version prior to 2.53 was found...

HP iLO 4 1.00-2.50 Authentication Bypass Administrator Account Creation

This module exploits an authentication bypass in HP iLO 4 1.00 to 2.50, triggered by a buffer overflow in the Connection HTTP header handling by the web server. Exploiting this vulnerability gives full access to the REST API, allowing arbitrary accounts creation. This module requires Metasploit:...

HPE iLO 4 < 2.53 - Add New Administrator User

!/usr/bin/env python """ Exploit trigger was presented @reconbrx 2018 Vulnerability found and documented by synacktiv: https://www.synacktiv.com/posts/exploit/rce-vulnerability-in-hp-ilo.html Original advisory from HP: https://support.hpe.com/hpsc/doc/public/display?docId=hpesbhf03769enus Other...