HP Integrated Lights-Out Firmware vulnerabilities

6 CVEs affecting HP Integrated Lights-Out Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-28092, published 2023-05-01.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-4805, published 2013-08-05. High severity, CVSS 9.0. EPSS: 3% chance of exploitation in the next 30 days. Unspecified vulnerability in HP Integrated Lights-Out 3 (aka iLO3) firmware before 1.60 and 4 (aka iLO4) firmware before 1.30 allows remote attackers to bypass authentication via unknown vectors.
CVE-2004-0525, published 2004-08-06. Medium severity, CVSS 5.0. EPSS: 2.7% chance of exploitation in the next 30 days. HP Integrated Lights-Out (iLO) 1.10 and other versions before 1.55 allows remote attackers to cause a denial of service (hang) by accessing iLO using the TCP/IP reserved port zero.
CVE-2013-4842, published 2013-11-18. Medium severity, CVSS 4.3. EPSS: 2.3% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in HP Integrated Lights-Out 4 (iLO4) with firmware before 1.32 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
CVE-2013-4843, published 2013-11-18. Medium severity, CVSS 6.8. EPSS: 1.8% chance of exploitation in the next 30 days. Unspecified vulnerability in HP Integrated Lights-Out 4 (iLO4) with firmware before 1.32 allows remote authenticated users to obtain sensitive information via unknown vectors.
CVE-2015-5436, published 2017-05-11. High severity, CVSS 7.5. EPSS: 1.6% chance of exploitation in the next 30 days. A potential security vulnerability has been identified with HP Integrated Lights-Out 4 (iLO 4) firmware version 2.11 and later, but prior to version 2.30. The vulnerability could be exploited…
CVE-2023-28092, published 2023-05-01. Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days. A potential security vulnerability has been identified in HPE ProLiant RL300 Gen11 Server. The vulnerability could result in the system being vulnerable to exploits by attackers with physical access…