CVE-2022-28630
First published: Thu Aug 11 2022(Updated: )
A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality and integrity, and a partial loss of availability. User interaction is required to exploit this vulnerability. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).
Credit: security-alert@hpe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| HPE Integrated Lights-Out 5 firmware | <2.71 | |
| HPE Apollo 2000 System | ||
| HPE Apollo 4200 Gen10 Plus System | ||
| HP Apollo 4510 System | ||
| HPE Apollo 6500 Gen10 Plus | ||
| HPE Apollo 6500 Gen10 Plus | ||
| HPE Apollo n2600 Gen10 Plus | ||
| HPE Apollo n2800 Gen10 Plus | ||
| HPE Apollo R2600 Gen10 | ||
| HPE Apollo r2800 Gen10 | ||
| HPE Edgeline E920 Server Blade | ||
| HPE Edgeline E920d Server Blade | ||
| HPE Edgeline E920t Server Blade | ||
| HPE ProLiant BL460c Gen10 Server Blade | ||
| HPE ProLiant DL110 Gen10 Plus Telco Server | ||
| HP ProLiant DL120 Gen10 Server | ||
| HP ProLiant DL160 Gen10 Server | ||
| HPE ProLiant DL180 Gen10 Server | ||
| HPE ProLiant DL20 Gen10 Plus Server | ||
| HPE ProLiant DL20 Gen10 Plus Server | ||
| HPE ProLiant DL325 Gen10 Plus Server | ||
| HPE ProLiant DL325 Gen10 Plus v2 Server | ||
| HPE ProLiant DL325 Gen10 Server | ||
| HPE ProLiant DL345 Gen10 Plus Server | ||
| HPE ProLiant DL360 Gen10 Plus Server | ||
| HP ProLiant DL360 Gen10 | ||
| HPE ProLiant DL365 Gen10 Plus Server | ||
| HPE ProLiant DL380 Gen10 Plus Server | ||
| HP ProLiant DL380 Gen10 | ||
| HPE ProLiant DX385 Gen10 Plus Server | ||
| HPE ProLiant DL385 Gen10 Plus v2 Server | ||
| HPE ProLiant DL385 Gen10 Server | ||
| HPE proliant dl560 gen10 server | ||
| HPE ProLiant DL580 Gen10 Server Firmware | ||
| HPE ProLiant DX170R Gen10 Server | ||
| HPE ProLiant DX190R Gen10 Server | ||
| HPE ProLiant DX220N Gen10 Plus Server | ||
| HPE ProLiant DX325 Gen10 Plus v2 Server | ||
| HPE ProLiant DX360 Gen10 Plus Server | ||
| HPE ProLiant DX360 Gen10 Server | ||
| HPE ProLiant DX380 Gen10 Plus Server | ||
| HPE ProLiant DX380 Gen10 Server | ||
| HPE ProLiant DX385 Gen10 Plus Server | ||
| HPE ProLiant DX385 Gen10 Plus v2 Server | ||
| HPE ProLiant DX4200 Gen10 Server | ||
| HPE ProLiant DX560 Gen10 Server | ||
| HPE ProLiant E910 Server Blade | ||
| HPE ProLiant E910T Server Blade | ||
| HPE ProLiant m750 Server Blade | ||
| HPE ProLiant MicroServer Gen10 Plus v2 | ||
| HP ProLiant ML110 Gen10 Server | ||
| HPE ProLiant ML30 Gen10 Plus Server | ||
| HPE ProLiant ML30 Gen10 | ||
| HP ProLiant ML350 Gen10 Server | ||
| HP ProLiant xl170r Gen10 | ||
| HP ProLiant xl190r Gen10 | ||
| HPE ProLiant XL220n Gen10 Plus Server | ||
| HPE ProLiant XL225N Gen10 Plus 1U Node | ||
| HP ProLiant XL230k Gen10 Server | ||
| HPE ProLiant XL270d Gen10 Server | ||
| HPE ProLiant XL290n Gen10 Plus Server | ||
| HPE ProLiant XL420 Gen10 Server | ||
| HPE ProLiant XL450 Gen10 Server Firmware | ||
| HPE ProLiant XL645D Gen10 Plus Server | ||
| HPE ProLiant XL675d Gen10 Plus Server | ||
| HPE ProLiant XL925 Gen10 Plus 1U 4-Node Configure-to-Order Server | ||
| HPE Storage File Controller | ||
| HPE Storage Performance File Controller | ||
| HPE StoreEasy 1460 Storage | ||
| HPE StoreEasy 1560 Storage | ||
| HPE StoreEasy 1660 Expanded Storage | ||
| HPE storeeasy 1660 performance storage | ||
| HPE StoreEasy 1660 Expanded Storage | ||
| HPE StoreEasy 1860 Performance Storage | ||
| HPE StoreEasy 1860 Performance Storage |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-28630?
CVE-2022-28630 is classified as a critical vulnerability due to its potential for local arbitrary code execution.
How do I fix CVE-2022-28630?
To address CVE-2022-28630, upgrade your HPE Integrated Lights-Out 5 firmware to version 2.71 or later.
Who is affected by CVE-2022-28630?
CVE-2022-28630 affects users of HPE Integrated Lights-Out 5 firmware versions prior to 2.71.
What type of vulnerability is CVE-2022-28630?
CVE-2022-28630 is a local arbitrary code execution vulnerability.
Can an unprivileged user exploit CVE-2022-28630?
Yes, an unprivileged user can exploit CVE-2022-28630 to execute arbitrary code.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/severity
- agent/last-modified-date
- agent/references
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/hpe
- canonical/hpe integrated lights-out 5 firmware
- canonical/hpe apollo 2000 system
- canonical/hpe apollo 4200 gen10 plus system
- canonical/hp apollo 4510 system
- canonical/hpe apollo 6500 gen10 plus
- canonical/hpe apollo n2600 gen10 plus
- canonical/hpe apollo n2800 gen10 plus
- canonical/hpe apollo r2600 gen10
- canonical/hpe apollo r2800 gen10
- canonical/hpe edgeline e920 server blade
- canonical/hpe edgeline e920d server blade
- canonical/hpe edgeline e920t server blade
- canonical/hpe proliant bl460c gen10 server blade
- canonical/hpe proliant dl110 gen10 plus telco server
- canonical/hp proliant dl120 gen10 server
- canonical/hp proliant dl160 gen10 server
- canonical/hpe proliant dl180 gen10 server
- canonical/hpe proliant dl20 gen10 plus server
- canonical/hpe proliant dl325 gen10 plus server
- canonical/hpe proliant dl325 gen10 plus v2 server
- canonical/hpe proliant dl325 gen10 server
- canonical/hpe proliant dl345 gen10 plus server
- canonical/hpe proliant dl360 gen10 plus server
- canonical/hp proliant dl360 gen10
- canonical/hpe proliant dl365 gen10 plus server
- canonical/hpe proliant dl380 gen10 plus server
- canonical/hp proliant dl380 gen10
- canonical/hpe proliant dx385 gen10 plus server
- canonical/hpe proliant dl385 gen10 plus v2 server
- canonical/hpe proliant dl385 gen10 server
- canonical/hpe proliant dl560 gen10 server
- canonical/hpe proliant dl580 gen10 server firmware
- canonical/hpe proliant dx170r gen10 server
- canonical/hpe proliant dx190r gen10 server
- canonical/hpe proliant dx220n gen10 plus server
- canonical/hpe proliant dx325 gen10 plus v2 server
- canonical/hpe proliant dx360 gen10 plus server
- canonical/hpe proliant dx360 gen10 server
- canonical/hpe proliant dx380 gen10 plus server
- canonical/hpe proliant dx380 gen10 server
- canonical/hpe proliant dx385 gen10 plus v2 server
- canonical/hpe proliant dx4200 gen10 server
- canonical/hpe proliant dx560 gen10 server
- canonical/hpe proliant e910 server blade
- canonical/hpe proliant e910t server blade
- canonical/hpe proliant m750 server blade
- canonical/hpe proliant microserver gen10 plus v2
- canonical/hp proliant ml110 gen10 server
- canonical/hpe proliant ml30 gen10 plus server
- canonical/hpe proliant ml30 gen10
- canonical/hp proliant ml350 gen10 server
- canonical/hp proliant xl170r gen10
- canonical/hp proliant xl190r gen10
- canonical/hpe proliant xl220n gen10 plus server
- canonical/hpe proliant xl225n gen10 plus 1u node
- canonical/hp proliant xl230k gen10 server
- canonical/hpe proliant xl270d gen10 server
- canonical/hpe proliant xl290n gen10 plus server
- canonical/hpe proliant xl420 gen10 server
- canonical/hpe proliant xl450 gen10 server firmware
- canonical/hpe proliant xl645d gen10 plus server
- canonical/hpe proliant xl675d gen10 plus server
- canonical/hpe proliant xl925 gen10 plus 1u 4-node configure-to-order server
- canonical/hpe storage file controller
- canonical/hpe storage performance file controller
- canonical/hpe storeeasy 1460 storage
- canonical/hpe storeeasy 1560 storage
- canonical/hpe storeeasy 1660 expanded storage
- canonical/hpe storeeasy 1660 performance storage
- canonical/hpe storeeasy 1860 performance storage