What it is about

HP Integrated Lights-Out (iLO) ist eine Server-Management Technologie bzw. wird es als Out-of-Band-Management-Technologie eingesetzt. Ein entfernter, anonymer Angreifer kann eine Schwachstelle in HPE Integrated Lights-Out ausnutzen, um seine Privilegien zu erhöhen.

Under what conditions?

Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.

What can happen in the worst case

An attacker could use the vulnerability to

• seine Privilegien zu erhöhen

Am I affected?

Affected according to the BSI:

• HPE Integrated Lights-Out 7 <1.25.01

The installed version is usually shown under “Help → About” or in the device’s admin interface.

What helps?

Update to at least:

• HPE Integrated Lights-Out 7 1.25.01

Is the vulnerability already being exploited?

None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.