HP Integrated Lights-Out 4 Firmware vulnerabilities

16 CVEs affecting HP Integrated Lights-Out 4 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-11983, published 2019-06-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2017-12542, published 2018-02-15. Critical severity, CVSS 10.0. EPSS: 99.3% chance of exploitation in the next 30 days. A authentication bypass and execution of code vulnerability in HPE Integrated Lights-out 4 (iLO 4) version prior to 2.53 was found.
CVE-2014-7876, published 2015-03-31. High severity, CVSS 10.0. EPSS: 12.8% chance of exploitation in the next 30 days. Unspecified vulnerability in HP Integrated Lights-Out (iLO) firmware 2 before 2.27 and 4 before 2.03 and iLO Chassis Management (CM) firmware before 1.30 allows remote attackers to gain privileges,…
CVE-2013-2338, published 2013-06-14. High severity, CVSS 10.0. EPSS: 10.4% chance of exploitation in the next 30 days. Unspecified vulnerability on HP Integrated Lights-Out 3 (aka iLO3) cards with firmware before 1.57 and 4 (aka iLO4) cards with firmware before 1.22, when Single-Sign-On (SSO) is used, allows remote…
CVE-2018-7101, published 2018-09-27. High severity, CVSS 7.5. EPSS: 7.2% chance of exploitation in the next 30 days. A potential remote denial of service security vulnerability has been identified in HPE Integrated Lights Out 4 prior to v2.60 and iLO 5 for Gen 10 servers prior to v1.30.
CVE-2018-7078, published 2018-08-06. High severity, CVSS 7.2. EPSS: 7% chance of exploitation in the next 30 days. A remote code execution was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than version v2.60 and HPE Integrated Lights-Out 5 (iLO 5) earlier than version v1.30.
CVE-2012-3271, published 2012-11-29. High severity, CVSS 9.3. EPSS: 5.1% chance of exploitation in the next 30 days. Unspecified vulnerability on the HP Integrated Lights-Out 3 (aka iLO3) with firmware before 1.50 and Integrated Lights-Out 4 (aka iLO4) with firmware before 1.13 allows remote attackers to obtain…
CVE-2018-7105, published 2018-09-27. High severity, CVSS 7.2. EPSS: 4.1% chance of exploitation in the next 30 days. A security vulnerability in HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers prior to v1.35, HPE Integrated Lights-Out 4 (iLO 4) prior to v2.61, HPE Integrated Lights-Out 3 (iLO 3) prior to…
CVE-2015-2106, published 2015-03-31. Medium severity, CVSS 6.4. EPSS: 3.5% chance of exploitation in the next 30 days. Unspecified vulnerability in HP Integrated Lights-Out (iLO) firmware 2 before 2.27, 3 before 1.82, and 4 before 2.10 allows remote attackers to bypass intended access restrictions or cause a denial…
CVE-2018-7093, published 2018-08-14. High severity, CVSS 8.6. EPSS: 3.5% chance of exploitation in the next 30 days. A security vulnerability in HPE Integrated Lights-Out 3 prior to v1.90, iLO 4 prior to v2.60, iLO 5 prior to v1.30, Moonshot Chassis Manager firmware prior to v1.58, and Moonshot Component Pack prior…
CVE-2016-4375, published 2016-09-08. Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in HPE Integrated Lights-Out 3 (aka iLO 3) firmware before 1.88, Integrated Lights-Out 4 (aka iLO 4) firmware before 2.44, and Integrated Lights-Out 4 (aka iLO 4)…

Latest

CVE-2019-11983, published 2019-06-05. High severity, CVSS 7.0. EPSS: 1.1% chance of exploitation in the next 30 days. A remote buffer overflow vulnerability was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than v2.61b for Gen9 servers and Integrated Lights-Out 5 (iLO 5) for Gen10 Servers earlier than…
CVE-2019-11982, published 2019-06-05. High severity, CVSS 8.3. EPSS: 2.1% chance of exploitation in the next 30 days. A remote cross site scripting vulnerability was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than v2.61b for Gen9 servers and Integrated Lights-Out 5 (iLO 5) for Gen10 Servers earlier…
CVE-2018-7112, published 2018-12-03. Medium severity, CVSS 5.5. EPSS: 0.7% chance of exploitation in the next 30 days. The HPE-provided Windows firmware installer for certain Gen9, Gen8, G7,and G6 HPE servers allows local disclosure of privileged information. This issue was resolved in previously provided firmware…
CVE-2016-4406, published 2018-08-06. Medium severity, CVSS 6.1. EPSS: 2.6% chance of exploitation in the next 30 days. A remote cross site scripting vulnerability was identified in HPE iLO 3 all version prior to v1.88 and HPE iLO 4 all versions prior to v2.44.
CVE-2017-12543, published 2018-02-15. Medium severity, CVSS 6.5. EPSS: 1.4% chance of exploitation in the next 30 days. A remote disclosure of information vulnerability in Moonshot Remote Console Administrator Prior to 2.50, iLO4 prior to v2.53, iLO3 prior to v1.89 and iLO2 prior to v2.30 was found.