CVE-2018-7105

HIGH

HPE Integrated Lights-Out 3/4/5 Firmware - Remote Code Execution

Title source: manual

Description

A security vulnerability in HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers prior to v1.35, HPE Integrated Lights-Out 4 (iLO 4) prior to v2.61, HPE Integrated Lights-Out 3 (iLO 3) prior to v1.90 could be remotely exploited to execute arbitrary code leading to disclosure of information.

References (3)

Core 3

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/105425

Mitigation, Vendor Advisory x_refsource_confirm

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03866en_us

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1041649

Scores

CVSS v3 7.2

EPSS 0.0150

EPSS Percentile 81.4%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

Status published

Products (3)

hp/integrated_lights-out_3_firmware < 1.90

hp/integrated_lights-out_4_firmware < 2.61

hp/integrated_lights-out_5_firmware < 1.35

Published Sep 27, 2018

Tracked Since Feb 18, 2026