Hpe Integrated Lights Out Ilo 7
Monthly
Remote user validation in HPE Integrated Lights-Out (iLO) 7 firmware can be subverted by unauthenticated network attackers, giving them high-impact confidentiality, integrity, and availability effects on the baseboard management controller and, because the CVSS vector carries a scope change (S:C), potentially on the systems that controller manages. The flaw is rated CVSS 3.1 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H); the high attack complexity means a successful bypass hinges on specific preconditions, state, or timing rather than one deterministic request, and reachability is limited to networks that can route to the iLO management interface. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so real-world risk concentrates in environments where iLO is exposed beyond a segmented out-of-band management network.
Remote user validation in HPE Integrated Lights-Out (iLO) 7 firmware can be subverted by unauthenticated network attackers, giving them high-impact confidentiality, integrity, and availability effects on the baseboard management controller and, because the CVSS vector carries a scope change (S:C), potentially on the systems that controller manages. The flaw is rated CVSS 3.1 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H); the high attack complexity means a successful bypass hinges on specific preconditions, state, or timing rather than one deterministic request, and reachability is limited to networks that can route to the iLO management interface. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so real-world risk concentrates in environments where iLO is exposed beyond a segmented out-of-band management network.