CVE-2022-28630
High
Description
A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality and integrity, and a partial loss of availability. User interaction is required to exploit this vulnerability. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).
SeverityHigh
CVSS7.3
Exploit probability—
ProductHpe Integrated Lights-out 5 Firmware
PublishedAug 12, 2022
First seenAug 12, 2022
How to fix
Update
- hpe integrated_lights-out_5_firmware2.71 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| hpe integrated_lights-out_5_firmware | v < 2.71 | 2.71 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.