PT-2022-19120 · Hewlett Packard · Hpe Integrated Lights-Out 5+1

Published 2022-07-28 · Updated 2022-08-16 · CVE-2022-28631

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions HPE Integrated Lights-Out 5 (iLO 5) versions prior to 2.71

Description A potential arbitrary code execution and a denial of service (DoS) vulnerability were discovered in the firmware. An unprivileged user could exploit this vulnerability in an adjacent network to potentially execute arbitrary code in an isolated process, resulting in a complete loss of confidentiality, integrity, and availability within that process. Additionally, an unprivileged user could exploit a denial of service (DoS) vulnerability in an isolated process, resulting in a complete loss of availability within that process.

Recommendations For versions prior to 2.71, update the firmware to the latest version provided by HPE to resolve the vulnerability. As a temporary workaround, consider restricting access to the isolated process to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2022-28631

Affected Products

Hpe Integrated Lights-Out 5

Hpe Ilo

References · 3

• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04333en_us · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28631 · Security Note
• https://osv.dev/vulnerability/CVE-2022-28631 · Vendor Advisory