Medium severity · published Feb 15, 2018
CVE-2017-12543
A remote disclosure of information vulnerability in Moonshot Remote Console Administrator Prior to 2.50, iLO4 prior to v2.53, iLO3 prior to v1.89 and iLO2 prior to v2.30 was found
6.5
CVSS
1.4%
EPSS
No
On KEV
Description
A remote disclosure of information vulnerability in Moonshot Remote Console Administrator Prior to 2.50, iLO4 prior to v2.53, iLO3 prior to v1.89 and iLO2 prior to v2.30 was found.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.4% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IL
Integrated Lights-out 2 Firmware · HP
before 2.30 · source: NVD
IL
Integrated Lights-out 3 Firmware · HP
before 1.89 · source: NVD
IL
Integrated Lights-out 4 Firmware · HP
before 2.53 · source: NVD
MR
Moonshot Remote Console Administrator · HP
before 2.50 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-12543
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-12543
Third Party Advisory
http://www.securityfocus.com/bid/101944
Vendor Advisory
https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-hpesbhf03705en_us
More from Integrated Lights-out 2 Firmware
9.8
CVE-2017-8979
Security vulnerabilities in the HPE Integrated Lights-Out 2 (iLO 2) firmware could be exploited remotely to allow authentication bypass, code execution, and denial of service
5.5
CVE-2018-7112
The HPE-provided Windows firmware installer for certain Gen9, Gen8, G7,and G6 HPE servers allows local disclosure of privileged information
–
CVE-2015-2106
Unspecified vulnerability in HP Integrated Lights-Out (iLO) firmware 2 before 2.27, 3 before 1.82, and 4 before 2.10 allows remote attackers to bypass intended access restrictions…
–
CVE-2014-7876
Unspecified vulnerability in HP Integrated Lights-Out (iLO) firmware 2 before 2.27 and 4 before 2.03 and iLO Chassis Management (CM) firmware before 1.30 allows remote attackers…
–
CVE-2014-2601
The server in HP Integrated Lights-Out 2 (aka iLO 2) 2.23 and earlier allows remote attackers to cause a denial of service via crafted HTTPS traffic, as demonstrated by traffic…