HP Integrated Lights-Out 5 Firmware vulnerabilities

9 CVEs affecting HP Integrated Lights-Out 5 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2021-46846, published 2022-12-12.

More from HP.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-7101, published 2018-09-27. High severity, CVSS 7.5. EPSS: 7.2% chance of exploitation in the next 30 days. A potential remote denial of service security vulnerability has been identified in HPE Integrated Lights Out 4 prior to v2.60 and iLO 5 for Gen 10 servers prior to v1.30.
• CVE-2018-7078, published 2018-08-06. High severity, CVSS 7.2. EPSS: 7% chance of exploitation in the next 30 days. A remote code execution was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than version v2.60 and HPE Integrated Lights-Out 5 (iLO 5) earlier than version v1.30.
• CVE-2018-7105, published 2018-09-27. High severity, CVSS 7.2. EPSS: 4.1% chance of exploitation in the next 30 days. A security vulnerability in HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers prior to v1.35, HPE Integrated Lights-Out 4 (iLO 4) prior to v2.61, HPE Integrated Lights-Out 3 (iLO 3) prior to…
• CVE-2018-7093, published 2018-08-14. High severity, CVSS 8.6. EPSS: 3.5% chance of exploitation in the next 30 days. A security vulnerability in HPE Integrated Lights-Out 3 prior to v1.90, iLO 4 prior to v2.60, iLO 5 prior to v1.30, Moonshot Chassis Manager firmware prior to v1.58, and Moonshot Component Pack prior…
• CVE-2019-11982, published 2019-06-05. High severity, CVSS 8.3. EPSS: 2.1% chance of exploitation in the next 30 days. A remote cross site scripting vulnerability was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than v2.61b for Gen9 servers and Integrated Lights-Out 5 (iLO 5) for Gen10 Servers earlier…
• CVE-2018-7117, published 2019-04-09. Medium severity, CVSS 6.1. EPSS: 1.3% chance of exploitation in the next 30 days. A remote Cross-Site Scripting in HPE iLO 5 Web User Interface vulnerability was identified in HPE Integrated Lights-Out 5 (iLO 5) for Gen10 ProLiant Servers earlier than version v1.40.
• CVE-2019-11983, published 2019-06-05. High severity, CVSS 7.0. EPSS: 1.1% chance of exploitation in the next 30 days. A remote buffer overflow vulnerability was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than v2.61b for Gen9 servers and Integrated Lights-Out 5 (iLO 5) for Gen10 Servers earlier than…
• CVE-2018-7113, published 2018-12-03. Medium severity, CVSS 6.6. EPSS: 0.7% chance of exploitation in the next 30 days. A security vulnerability in HPE Integrated Lights-Out 5 (iLO 5) prior to v1.37 could be locally exploited to bypass the security restrictions for firmware updates.
• CVE-2021-46846, published 2022-12-12. Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days. Cross Site Scripting vulnerability in Hewlett Packard Enterprise Integrated Lights-Out 5.