HP Integrated Lights-Out 2 Firmware vulnerabilities

6 CVEs affecting HP Integrated Lights-Out 2 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-7112, published 2018-12-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-7876, published 2015-03-31. High severity, CVSS 10.0. EPSS: 12.8% chance of exploitation in the next 30 days. Unspecified vulnerability in HP Integrated Lights-Out (iLO) firmware 2 before 2.27 and 4 before 2.03 and iLO Chassis Management (CM) firmware before 1.30 allows remote attackers to gain privileges,…
CVE-2017-8979, published 2018-02-15. Critical severity, CVSS 9.8. EPSS: 4.8% chance of exploitation in the next 30 days. Security vulnerabilities in the HPE Integrated Lights-Out 2 (iLO 2) firmware could be exploited remotely to allow authentication bypass, code execution, and denial of service.
CVE-2014-2601, published 2014-04-24. High severity, CVSS 7.8. EPSS: 4% chance of exploitation in the next 30 days. The server in HP Integrated Lights-Out 2 (aka iLO 2) 2.23 and earlier allows remote attackers to cause a denial of service via crafted HTTPS traffic, as demonstrated by traffic from a CVE-2014-0160…
CVE-2015-2106, published 2015-03-31. Medium severity, CVSS 6.4. EPSS: 3.5% chance of exploitation in the next 30 days. Unspecified vulnerability in HP Integrated Lights-Out (iLO) firmware 2 before 2.27, 3 before 1.82, and 4 before 2.10 allows remote attackers to bypass intended access restrictions or cause a denial…
CVE-2017-12543, published 2018-02-15. Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days. A remote disclosure of information vulnerability in Moonshot Remote Console Administrator Prior to 2.50, iLO4 prior to v2.53, iLO3 prior to v1.89 and iLO2 prior to v2.30 was found.
CVE-2018-7112, published 2018-12-03. Medium severity, CVSS 5.5. EPSS: 0.7% chance of exploitation in the next 30 days. The HPE-provided Windows firmware installer for certain Gen9, Gen8, G7,and G6 HPE servers allows local disclosure of privileged information. This issue was resolved in previously provided firmware…