High severity · published Aug 6, 2018
CVE-2018-7078
A remote code execution was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than version v2.60 and HPE Integrated Lights-Out 5 (iLO 5) earlier than version v1.30
7.2
CVSS
7%
EPSS
No
On KEV
Description
A remote code execution was identified in HPE Integrated Lights-Out 4 (iLO 4) earlier than version v2.60 and HPE Integrated Lights-Out 5 (iLO 5) earlier than version v1.30.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)7.0% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
HI
HPE Integrated Lights-Out 4 (iLO 4), HPE Integrated Lights-Out 5 (iLO 5) · Hewlett Packard Enterprise
iLO 4 earlier than version v2.60, iLO 5 earlier than version v1.30 · source: vendor
IL
Integrated Lights-out 4 Firmware · HP
before 2.60 · source: NVD
IL
Integrated Lights-out 5 Firmware · HP
before 1.30 · source: NVD
Affected product
HI
HPE Integrated Lights-Out 4 (iLO 4), HPE Integrated Lights-Out 5 (iLO 5)
Hewlett Packard Enterprise