Medium severity · published Dec 3, 2018
CVE-2018-7112
The HPE-provided Windows firmware installer for certain Gen9, Gen8, G7,and G6 HPE servers allows local disclosure of privileged information
5.5
CVSS
0.7%
EPSS
No
On KEV
Description
The HPE-provided Windows firmware installer for certain Gen9, Gen8, G7,and G6 HPE servers allows local disclosure of privileged information. This issue was resolved in previously provided firmware updates as follows. The HPE Windows firmware installer was updated in the system ROM updates which also addressed the original Spectre/Meltdown set of vulnerabilities. At that time, the Windows firmware installer was also updated in the versions of HPE Integrated Lights-Out 2, 3, and 4 (iLO 2, 3, and 4) listed in the security bulletin. The updated HPE Windows firmware installer was released in the system ROM and HPE Integrated Lights-Out (iLO) releases documented in earlier HPE Security Bulletins: HPESBHF03805, HPESBHF03835, HPESBHF03831. Windows-based systems that have already been updated to the system ROM or iLO versions described in these security bulletins require no further action.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 52% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IL
Integrated Lights-out 2 Firmware · HP
before 2.33 · source: NVD
IL
Integrated Lights-out 3 Firmware · HP
before 1.90 · source: NVD
IL
Integrated Lights-out 4 Firmware · HP
before 2.60 · source: NVD
PB
Proliant Bl420c Gen8 Server Firmware · HP
before 2018.01.22 · source: NVD
PB
Proliant Bl460c Gen8 Server Blade Firmware · HP
before 2018.01.22 · source: NVD
PB
Proliant Bl460c Gen9 Server Blade Firmware · HP
before 2.56_01-22-2018 · source: NVD
PB
Proliant Bl465c Gen8 (amd) Firmware · HP
before 2018.03.14 · source: NVD
PB
Proliant Bl660c Gen8 Server Blade Firmware · HP
before 2018.01.22 · source: NVD
PB
Proliant Bl660c Gen9 Server Firmware · HP
before 2.56_01-22-2018 · source: NVD
PD
Proliant Dl120 Gen9 Server Firmware · HP
before 2.56_01-22-2018 · source: NVD
PD
Proliant Dl160 Gen8 Server Firmware · HP
before 2018.01.22 · source: NVD
PD
Proliant Dl160 Gen9 Server Firmware · HP
before 2.56_01-22-2018 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-7112
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-7112
Third Party Advisory
http://www.securitytracker.com/id/1041984
Not Applicable
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03805en_us
Not Applicable
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03831en_us
Not Applicable
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03835en_us
Vendor Advisory
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03869en_us
More from Integrated Lights-out 2 Firmware
9.8
CVE-2017-8979
Security vulnerabilities in the HPE Integrated Lights-Out 2 (iLO 2) firmware could be exploited remotely to allow authentication bypass, code execution, and denial of service
6.5
CVE-2017-12543
A remote disclosure of information vulnerability in Moonshot Remote Console Administrator Prior to 2.50, iLO4 prior to v2.53, iLO3 prior to v1.89 and iLO2 prior to v2.30 was found
–
CVE-2015-2106
Unspecified vulnerability in HP Integrated Lights-Out (iLO) firmware 2 before 2.27, 3 before 1.82, and 4 before 2.10 allows remote attackers to bypass intended access restrictions…
–
CVE-2014-7876
Unspecified vulnerability in HP Integrated Lights-Out (iLO) firmware 2 before 2.27 and 4 before 2.03 and iLO Chassis Management (CM) firmware before 1.30 allows remote attackers…
–
CVE-2014-2601
The server in HP Integrated Lights-Out 2 (aka iLO 2) 2.23 and earlier allows remote attackers to cause a denial of service via crafted HTTPS traffic, as demonstrated by traffic…