High severity · published Oct 19, 2017
CVE-2017-10265
Vulnerability in the Oracle Integrated Lights Out Manager (ILOM) component of Oracle Sun Systems Products Suite (subcomponent: System Management)
7.3
CVSS
1.2%
EPSS
No
On KEV
Description
Vulnerability in the Oracle Integrated Lights Out Manager (ILOM) component of Oracle Sun Systems Products Suite (subcomponent: System Management). The supported version that is affected is Prior to 3.2.6. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Integrated Lights Out Manager (ILOM). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Integrated Lights Out Manager (ILOM) accessible data as well as unauthorized read access to a subset of Oracle Integrated Lights Out Manager (ILOM) accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Integrated Lights Out Manager (ILOM). CVSS 3.0 Base Score 7.3 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L).
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IL
Integrated Lights Out Manager Firmware · Oracle
through 3.2.5 · source: NVD
Affected product
IL
Integrated Lights Out Manager Firmware
Oracle
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-10265
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-10265
Patch
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
Third Party Advisory
http://www.securityfocus.com/bid/101431
More from Integrated Lights Out Manager Firmware
9.8
CVE-2016-5453
Unspecified vulnerability in the ILOM component in Oracle Sun Systems Products Suite 3.0, 3.1, and 3.2 allows remote attackers to affect confidentiality, integrity, and…
8.8
CVE-2016-5457
Unspecified vulnerability in the ILOM component in Oracle Sun Systems Products Suite 3.0, 3.1, and 3.2 allows remote authenticated users to affect confidentiality, integrity, and…
8.3
CVE-2016-5445
Unspecified vulnerability in the ILOM component in Oracle Sun Systems Products Suite 3.0, 3.1, and 3.2 allows remote attackers to affect confidentiality, integrity, and…
7.7
CVE-2018-2566
Vulnerability in the Integrated Lights Out Manager (ILOM) component of Oracle Sun Systems Products Suite (subcomponent: Remote Console Application)
7.7
CVE-2016-3481
Unspecified vulnerability in the ILOM component in Oracle Sun Systems Products Suite 3.0, 3.1, and 3.2 allows remote authenticated users to affect availability via vectors related…