CVE Feed

    Dashboard / CVE / CVE-2022-28627

    CVE-2022-28627

    A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality, integrity, and availability. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).

    Published:Aug 11, 2022
    Last Modified:Nov 21, 2024
    EPS:Aug 11, 2022
    EPSS Score:0.00056
    CVSS Score:8.4

    Affected Products

    Vendor
    Hpe
    Product
    Apollo 2000 Gen10 Plus System
    Vendor
    Hpe
    Product
    Apollo 4200 Gen10 Server
    Vendor
    Hpe
    Product
    Apollo 4510 Gen10 System
    Vendor
    Hpe
    Product
    Apollo 6500 Gen10 Plus System
    Vendor
    Hpe
    Product
    Apollo 6500 Gen10 System
    Vendor
    Hpe
    Product
    Apollo N2600 Gen10 Plus
    Vendor
    Hpe
    Product
    Apollo N2800 Gen10 Plus
    Vendor
    Hpe
    Product
    Apollo R2600 Gen10
    Vendor
    Hpe
    Product
    Apollo R2800 Gen10
    Vendor
    Hpe
    Product
    Edgeline E920 Server Blade
    Vendor
    Hpe
    Product
    Edgeline E920d Server Blade
    Vendor
    Hpe
    Product
    Edgeline E920t Server Blade
    Vendor
    Hpe
    Product
    Integrated Lights-out 5 Firmware
    Vendor
    Hpe
    Product
    Proliant Bl460c Gen10 Server Blade
    Vendor
    Hpe
    Product
    Proliant Dl110 Gen10 Plus Telco Server
    Vendor
    Hpe
    Product
    Proliant Dl120 Gen10 Server
    Vendor
    Hpe
    Product
    Proliant Dl160 Gen10 Server
    Vendor
    Hpe
    Product
    Proliant Dl180 Gen10 Server
    Vendor
    Hpe
    Product
    Proliant Dl20 Gen10 Plus Server
    Vendor
    Hpe
    Product
    Proliant Dl20 Gen10 Server
    Vendor
    Hpe
    Product
    Proliant Dl325 Gen10 Plus Server
    Vendor
    Hpe
    Product
    Proliant Dl325 Gen10 Plus V2 Server
    Vendor
    Hpe
    Product
    Proliant Dl325 Gen10 Server
    Vendor
    Hpe
    Product
    Proliant Dl345 Gen10 Plus Server
    Vendor
    Hpe
    Product
    Proliant Dl360 Gen10 Plus Server
    Vendor
    Hpe
    Product
    Proliant Dl360 Gen10 Server
    Vendor
    Hpe
    Product
    Proliant Dl365 Gen10 Plus Server
    Vendor
    Hpe
    Product
    Proliant Dl380 Gen10 Plus Server
    Vendor
    Hpe
    Product
    Proliant Dl380 Gen10 Server
    Vendor
    Hpe
    Product
    Proliant Dl385 Gen10 Plus Server
    Vendor
    Hpe
    Product
    Proliant Dl385 Gen10 Plus V2 Server
    Vendor
    Hpe
    Product
    Proliant Dl385 Gen10 Server
    Vendor
    Hpe
    Product
    Proliant Dl560 Gen10 Server
    Vendor
    Hpe
    Product
    Proliant Dl580 Gen10 Server
    Vendor
    Hpe
    Product
    Proliant Dx170r Gen10 Server
    Vendor
    Hpe
    Product
    Proliant Dx190r Gen10 Server
    Vendor
    Hpe
    Product
    Proliant Dx220n Gen10 Plus Server
    Vendor
    Hpe
    Product
    Proliant Dx325 Gen10 Plus V2 Server
    Vendor
    Hpe
    Product
    Proliant Dx360 Gen10 Plus Server
    Vendor
    Hpe
    Product
    Proliant Dx360 Gen10 Server
    Vendor
    Hpe
    Product
    Proliant Dx380 Gen10 Plus Server
    Vendor
    Hpe
    Product
    Proliant Dx380 Gen10 Server
    Vendor
    Hpe
    Product
    Proliant Dx385 Gen10 Plus Server
    Vendor
    Hpe
    Product
    Proliant Dx385 Gen10 Plus V2 Server
    Vendor
    Hpe
    Product
    Proliant Dx4200 Gen10 Server
    Vendor
    Hpe
    Product
    Proliant Dx560 Gen10 Server
    Vendor
    Hpe
    Product
    Proliant E910 Server Blade
    Vendor
    Hpe
    Product
    Proliant E910t Server Blade
    Vendor
    Hpe
    Product
    Proliant M750 Server Blade
    Vendor
    Hpe
    Product
    Proliant Microserver Gen10 Plus
    Vendor
    Hpe
    Product
    Proliant Ml110 Gen10 Server
    Vendor
    Hpe
    Product
    Proliant Ml30 Gen10 Plus Server
    Vendor
    Hpe
    Product
    Proliant Ml30 Gen10 Server
    Vendor
    Hpe
    Product
    Proliant Ml350 Gen10 Server
    Vendor
    Hpe
    Product
    Proliant Xl170r Gen10 Server
    Vendor
    Hpe
    Product
    Proliant Xl190r Gen10 Server
    Vendor
    Hpe
    Product
    Proliant Xl220n Gen10 Plus Server
    Vendor
    Hpe
    Product
    Proliant Xl225n Gen10 Plus 1u Node
    Vendor
    Hpe
    Product
    Proliant Xl230k Gen10 Server
    Vendor
    Hpe
    Product
    Proliant Xl270d Gen10 Server
    Vendor
    Hpe
    Product
    Proliant Xl290n Gen10 Plus Server
    Vendor
    Hpe
    Product
    Proliant Xl420 Gen10 Server
    Vendor
    Hpe
    Product
    Proliant Xl450 Gen10 Server
    Vendor
    Hpe
    Product
    Proliant Xl645d Gen10 Plus Server
    Vendor
    Hpe
    Product
    Proliant Xl675d Gen10 Plus Server
    Vendor
    Hpe
    Product
    Proliant Xl925g Gen10 Plus Server
    Vendor
    Hpe
    Product
    Storage File Controller
    Vendor
    Hpe
    Product
    Storage Performance File Controller
    Vendor
    Hpe
    Product
    Storeeasy 1460 Storage
    Vendor
    Hpe
    Product
    Storeeasy 1560 Storage
    Vendor
    Hpe
    Product
    Storeeasy 1660 Expanded Storage
    Vendor
    Hpe
    Product
    Storeeasy 1660 Performance Storage
    Vendor
    Hpe
    Product
    Storeeasy 1660 Storage
    Vendor
    Hpe
    Product
    Storeeasy 1860 Performance Storage
    Vendor
    Hpe
    Product
    Storeeasy 1860 Storage

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2021-46846 (CVSS 6.4) — Cross Site Scripting vulnerability in Hewlett Packard Enterprise Integrated Lights-Out 5. …
    CVE-2022-28637 (CVSS 7.8) — A local Denial of Service (DoS) and local arbitrary code execution vulnerability that could potentially lead t…
    CVE-2022-28639 (CVSS 8.8) — A remote potential adjacent denial of service (DoS) and potential adjacent arbitrary code execution vulnerabil…
    CVE-2022-28638 (CVSS 7.8) — An isolated local disclosure of information and potential isolated local arbitrary code execution vulnerabilit…
    CVE-2022-28640 (CVSS 8.8) — A potential local adjacent arbitrary code execution vulnerability that could potentially lead to a loss of con…
    CVE-2022-28634 (CVSS 6.7) — A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware …
    CVE-2022-28633 (CVSS 7.3) — A local disclosure of sensitive information and a local unauthorized data modification vulnerability were disc…
    CVE-2022-28635 (CVSS 7.4) — A potential local arbitrary code execution and a local denial of service (DoS) vulnerability within an isolate…
    CVE-2022-28636 (CVSS 7.4) — A potential local arbitrary code execution and a local denial of service (DoS) vulnerability within an isolate…
    CVE-2022-28632 (CVSS 8.8) — A potential arbitrary code execution and a denial of service (DoS) vulnerability within an isolated process we…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High