A local disclosure of sensitive information and a local unauthorized data modification vulnerability were discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could locally exploit this vulnerability to read and write to the iLO 5 firmware file system resulting in a complete loss of confidentiality and a partial loss of integrity and availability. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00057.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Hpe Subscribe
Apollo 2000 Gen10 Plus System Subscribe
Apollo 4200 Gen10 Server Subscribe
Apollo 4510 Gen10 System Subscribe
Apollo 6500 Gen10 Plus System Subscribe
Apollo 6500 Gen10 System Subscribe
Apollo N2600 Gen10 Plus Subscribe
Apollo N2800 Gen10 Plus Subscribe
Apollo R2600 Gen10 Subscribe
Apollo R2800 Gen10 Subscribe
Edgeline E920 Server Blade Subscribe
Edgeline E920d Server Blade Subscribe
Edgeline E920t Server Blade Subscribe
Integrated Lights-out 5 Firmware Subscribe
Proliant Bl460c Gen10 Server Blade Subscribe
Proliant Dl110 Gen10 Plus Telco Server Subscribe
Proliant Dl120 Gen10 Server Subscribe
Proliant Dl160 Gen10 Server Subscribe
Proliant Dl180 Gen10 Server Subscribe
Proliant Dl20 Gen10 Plus Server Subscribe
Proliant Dl20 Gen10 Server Subscribe
Proliant Dl325 Gen10 Plus Server Subscribe
Proliant Dl325 Gen10 Plus V2 Server Subscribe
Proliant Dl325 Gen10 Server Subscribe
Proliant Dl345 Gen10 Plus Server Subscribe
Proliant Dl360 Gen10 Plus Server Subscribe
Proliant Dl360 Gen10 Server Subscribe
Proliant Dl365 Gen10 Plus Server Subscribe
Proliant Dl380 Gen10 Plus Server Subscribe
Proliant Dl380 Gen10 Server Subscribe
Proliant Dl385 Gen10 Plus Server Subscribe
Proliant Dl385 Gen10 Plus V2 Server Subscribe
Proliant Dl385 Gen10 Server Subscribe
Proliant Dl560 Gen10 Server Subscribe
Proliant Dl580 Gen10 Server Subscribe
Proliant Dx170r Gen10 Server Subscribe
Proliant Dx190r Gen10 Server Subscribe
Proliant Dx220n Gen10 Plus Server Subscribe
Proliant Dx325 Gen10 Plus V2 Server Subscribe
Proliant Dx360 Gen10 Plus Server Subscribe
Proliant Dx360 Gen10 Server Subscribe
Proliant Dx380 Gen10 Plus Server Subscribe
Proliant Dx380 Gen10 Server Subscribe
Proliant Dx385 Gen10 Plus Server Subscribe
Proliant Dx385 Gen10 Plus V2 Server Subscribe
Proliant Dx4200 Gen10 Server Subscribe
Proliant Dx560 Gen10 Server Subscribe
Proliant E910 Server Blade Subscribe
Proliant E910t Server Blade Subscribe
Proliant M750 Server Blade Subscribe
Proliant Microserver Gen10 Plus Subscribe
Proliant Ml110 Gen10 Server Subscribe
Proliant Ml30 Gen10 Plus Server Subscribe
Proliant Ml30 Gen10 Server Subscribe
Proliant Ml350 Gen10 Server Subscribe
Proliant Xl170r Gen10 Server Subscribe
Proliant Xl190r Gen10 Server Subscribe
Proliant Xl220n Gen10 Plus Server Subscribe
Proliant Xl225n Gen10 Plus 1u Node Subscribe
Proliant Xl230k Gen10 Server Subscribe
Proliant Xl270d Gen10 Server Subscribe
Proliant Xl290n Gen10 Plus Server Subscribe
Proliant Xl420 Gen10 Server Subscribe
Proliant Xl450 Gen10 Server Subscribe
Proliant Xl645d Gen10 Plus Server Subscribe
Proliant Xl675d Gen10 Plus Server Subscribe
Proliant Xl925g Gen10 Plus Server Subscribe
Storage File Controller Subscribe
Storage Performance File Controller Subscribe
Storeeasy 1460 Storage Subscribe
Storeeasy 1560 Storage Subscribe
Storeeasy 1660 Expanded Storage Subscribe
Storeeasy 1660 Performance Storage Subscribe
Storeeasy 1660 Storage Subscribe
Storeeasy 1860 Performance Storage Subscribe
Storeeasy 1860 Storage Subscribe

Configuration 1 [-]

AND
cpe:2.3:o:hpe:integrated_lights-out_5_firmware:*:*:*:*:*:*:*:*
OR cpe:2.3:h:hpe:apollo_2000_gen10_plus_system:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:apollo_4200_gen10_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:apollo_4510_gen10_system:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:apollo_6500_gen10_plus_system:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:apollo_6500_gen10_system:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:apollo_n2600_gen10_plus:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:apollo_n2800_gen10_plus:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:apollo_r2600_gen10:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:apollo_r2800_gen10:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:edgeline_e920_server_blade:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:edgeline_e920d_server_blade:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:edgeline_e920t_server_blade:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_bl460c_gen10_server_blade:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dl110_gen10_plus_telco_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dl120_gen10_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dl160_gen10_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dl180_gen10_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dl20_gen10_plus_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dl20_gen10_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dl325_gen10_plus_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dl325_gen10_plus_v2_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dl325_gen10_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dl345_gen10_plus_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dl360_gen10_plus_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dl360_gen10_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dl365_gen10_plus_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dl380_gen10_plus_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dl380_gen10_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dl385_gen10_plus_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dl385_gen10_plus_v2_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dl385_gen10_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dl560_gen10_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dl580_gen10_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dx170r_gen10_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dx190r_gen10_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dx220n_gen10_plus_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dx325_gen10_plus_v2_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dx360_gen10_plus_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dx360_gen10_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dx380_gen10_plus_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dx380_gen10_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dx385_gen10_plus_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dx385_gen10_plus_v2_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dx4200_gen10_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_dx560_gen10_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_e910_server_blade:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_e910t_server_blade:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_m750_server_blade:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_microserver_gen10_plus:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_ml110_gen10_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_ml30_gen10_plus_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_ml30_gen10_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_ml350_gen10_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_xl170r_gen10_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_xl190r_gen10_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_xl220n_gen10_plus_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_xl225n_gen10_plus_1u_node:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_xl230k_gen10_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_xl270d_gen10_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_xl290n_gen10_plus_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_xl420_gen10_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_xl450_gen10_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_xl645d_gen10_plus_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_xl675d_gen10_plus_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:proliant_xl925g_gen10_plus_server:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:storage_file_controller:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:storage_performance_file_controller:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:storeeasy_1460_storage:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:storeeasy_1560_storage:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:storeeasy_1660_expanded_storage:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:storeeasy_1660_performance_storage:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:storeeasy_1660_storage:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:storeeasy_1860_performance_storage:-:*:*:*:*:*:*:*
cpe:2.3:h:hpe:storeeasy_1860_storage:-:*:*:*:*:*:*:*

No data.

No data.

Advisories
Source ID Title
EUVD EUVD EUVD-2022-33075 A local disclosure of sensitive information and a local unauthorized data modification vulnerability were discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could locally exploit this vulnerability to read and write to the iLO 5 firmware file system resulting in a complete loss of confidentiality and a partial loss of integrity and availability. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04333en_us cve-icon cve-icon
History

No history.

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: hpe

Published:

Updated: 2024-08-03T05:56:16.040Z

Reserved: 2022-04-04T00:00:00

Link: CVE-2022-28633

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2022-08-12T15:15:14.337

Modified: 2024-11-21T06:57:37.317

Link: CVE-2022-28633

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses