CVE-2022-28634
First published: Thu Aug 11 2022(Updated: )
A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. A highly privileged user could locally exploit this vulnerability to execute arbitrary code resulting in a complete loss of confidentiality, integrity, and availability. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 5 (iLO 5).
Credit: security-alert@hpe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| HP Integrated Lights-Out 5 | <2.71 | |
| HPE Apollo 2000 System | ||
| HPE Apollo 4200 Gen10 Plus System | ||
| HP Apollo 4510 System | ||
| HPE Apollo 6500 Gen10 Plus | ||
| HPE Apollo 6500 Gen10 Plus | ||
| HPE Apollo n2600 Gen10 Plus | ||
| HPE Apollo n2800 Gen10 Plus | ||
| HPE Apollo R2600 Gen10 | ||
| HPE Apollo r2800 Gen10 | ||
| HPE Edgeline E920 Server Blade | ||
| HPE Edgeline E920d Server Blade | ||
| HPE Edgeline E920t Server Blade | ||
| HPE ProLiant BL460c Gen10 Server Blade | ||
| HPE ProLiant DL110 Gen10 Plus Telco Server | ||
| HP ProLiant DL120 Gen10 Server | ||
| HP ProLiant DL160 Gen10 Server | ||
| HPE ProLiant DL180 Gen10 Server | ||
| HPE ProLiant DL20 Gen10 Plus Server | ||
| HPE ProLiant DL20 Gen10 Plus Server | ||
| HPE ProLiant DL325 Gen10 Plus Server | ||
| HPE ProLiant DL325 Gen10 Plus v2 Server | ||
| HPE ProLiant DL325 Gen10 Server | ||
| HPE ProLiant DL345 Gen10 Plus Server | ||
| HPE ProLiant DL360 Gen10 Plus Server | ||
| HP ProLiant DL360 Gen10 | ||
| HPE ProLiant DL365 Gen10 Plus Server | ||
| HPE ProLiant DL380 Gen10 Plus Server | ||
| HP ProLiant DL380 Gen10 | ||
| HPE ProLiant DX385 Gen10 Plus Server | ||
| HPE ProLiant DL385 Gen10 Plus v2 Server | ||
| HPE ProLiant DL385 Gen10 Server | ||
| HPE ProLiant DL560 Gen10 Server | ||
| HPE ProLiant DL580 Gen10 Server Firmware | ||
| HPE ProLiant DX170R Gen10 Server | ||
| HPE ProLiant DX190R Gen10 Server | ||
| HPE ProLiant DX220N Gen10 Plus Server | ||
| HPE ProLiant DX325 Gen10 Plus v2 Server | ||
| HPE ProLiant DX360 Gen10 Plus Server | ||
| HPE ProLiant DX360 Gen10 Server | ||
| HPE ProLiant DX380 Gen10 Plus Server | ||
| HPE ProLiant DX380 Gen10 Server | ||
| HPE ProLiant DX385 Gen10 Plus Server | ||
| HPE ProLiant DX385 Gen10 Plus v2 Server | ||
| HPE ProLiant DX4200 Gen10 Server | ||
| HPE ProLiant DX560 Gen10 Server | ||
| HPE ProLiant E910 Server Blade | ||
| HPE ProLiant E910T Server Blade | ||
| HPE ProLiant m750 Server Blade | ||
| HPE ProLiant MicroServer Gen10 Plus v2 | ||
| HP ProLiant ML110 Gen10 Server | ||
| HPE ProLiant ML30 Gen10 Plus Server | ||
| HPE ProLiant ML30 Gen10 | ||
| HP ProLiant ML350 Gen10 Server | ||
| HP ProLiant xl170r Gen10 | ||
| HP ProLiant xl190r Gen10 | ||
| HPE ProLiant XL220n Gen10 Plus Server | ||
| HPE ProLiant XL225N Gen10 Plus 1U Node | ||
| HP ProLiant XL230k Gen10 Server | ||
| HPE ProLiant XL270d Gen10 Server | ||
| HPE ProLiant XL290n Gen10 Plus Server | ||
| HPE ProLiant XL420 Gen10 Server | ||
| HPE ProLiant XL450 Gen10 Server Firmware | ||
| HPE ProLiant XL645D Gen10 Plus Server | ||
| HPE ProLiant XL675d Gen10 Plus Server | ||
| HPE ProLiant XL925 Gen10 Plus 1U 4-Node Configure-to-Order Server | ||
| HPE Storage File Controller | ||
| HPE Storage Performance File Controller | ||
| HPE StoreEasy 1460 Storage | ||
| HPE StoreEasy 1560 Storage | ||
| HPE StoreEasy 1660 Expanded Storage | ||
| HPE StoreEasy 1660 Performance Storage | ||
| HPE StoreEasy 1660 Expanded Storage | ||
| HPE StoreEasy 1860 Performance Storage | ||
| HPE StoreEasy 1860 Performance Storage |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2022-28634?
The severity of CVE-2022-28634 is critical due to its potential for arbitrary code execution.
How do I fix CVE-2022-28634?
To fix CVE-2022-28634, upgrade HPE Integrated Lights-Out 5 firmware to version 2.71 or later.
Who is affected by CVE-2022-28634?
CVE-2022-28634 affects HPE Integrated Lights-Out 5 firmware versions prior to 2.71.
What are the potential impacts of CVE-2022-28634?
The potential impacts of CVE-2022-28634 include a complete loss of confidentiality, integrity, and availability of the affected system.
How does CVE-2022-28634 work?
CVE-2022-28634 allows a highly privileged user to locally exploit the vulnerability to execute arbitrary code.
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/severity
- agent/last-modified-date
- agent/references
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-index
- agent/software-canonical-lookup-request
- vendor/hpe
- canonical/hp integrated lights-out 5
- canonical/hpe apollo 2000 system
- canonical/hpe apollo 4200 gen10 plus system
- canonical/hp apollo 4510 system
- canonical/hpe apollo 6500 gen10 plus
- canonical/hpe apollo n2600 gen10 plus
- canonical/hpe apollo n2800 gen10 plus
- canonical/hpe apollo r2600 gen10
- canonical/hpe apollo r2800 gen10
- canonical/hpe edgeline e920 server blade
- canonical/hpe edgeline e920d server blade
- canonical/hpe edgeline e920t server blade
- canonical/hpe proliant bl460c gen10 server blade
- canonical/hpe proliant dl110 gen10 plus telco server
- canonical/hp proliant dl120 gen10 server
- canonical/hp proliant dl160 gen10 server
- canonical/hpe proliant dl180 gen10 server
- canonical/hpe proliant dl20 gen10 plus server
- canonical/hpe proliant dl325 gen10 plus server
- canonical/hpe proliant dl325 gen10 plus v2 server
- canonical/hpe proliant dl325 gen10 server
- canonical/hpe proliant dl345 gen10 plus server
- canonical/hpe proliant dl360 gen10 plus server
- canonical/hp proliant dl360 gen10
- canonical/hpe proliant dl365 gen10 plus server
- canonical/hpe proliant dl380 gen10 plus server
- canonical/hp proliant dl380 gen10
- canonical/hpe proliant dx385 gen10 plus server
- canonical/hpe proliant dl385 gen10 plus v2 server
- canonical/hpe proliant dl385 gen10 server
- canonical/hpe proliant dl560 gen10 server
- canonical/hpe proliant dl580 gen10 server firmware
- canonical/hpe proliant dx170r gen10 server
- canonical/hpe proliant dx190r gen10 server
- canonical/hpe proliant dx220n gen10 plus server
- canonical/hpe proliant dx325 gen10 plus v2 server
- canonical/hpe proliant dx360 gen10 plus server
- canonical/hpe proliant dx360 gen10 server
- canonical/hpe proliant dx380 gen10 plus server
- canonical/hpe proliant dx380 gen10 server
- canonical/hpe proliant dx385 gen10 plus v2 server
- canonical/hpe proliant dx4200 gen10 server
- canonical/hpe proliant dx560 gen10 server
- canonical/hpe proliant e910 server blade
- canonical/hpe proliant e910t server blade
- canonical/hpe proliant m750 server blade
- canonical/hpe proliant microserver gen10 plus v2
- canonical/hp proliant ml110 gen10 server
- canonical/hpe proliant ml30 gen10 plus server
- canonical/hpe proliant ml30 gen10
- canonical/hp proliant ml350 gen10 server
- canonical/hp proliant xl170r gen10
- canonical/hp proliant xl190r gen10
- canonical/hpe proliant xl220n gen10 plus server
- canonical/hpe proliant xl225n gen10 plus 1u node
- canonical/hp proliant xl230k gen10 server
- canonical/hpe proliant xl270d gen10 server
- canonical/hpe proliant xl290n gen10 plus server
- canonical/hpe proliant xl420 gen10 server
- canonical/hpe proliant xl450 gen10 server firmware
- canonical/hpe proliant xl645d gen10 plus server
- canonical/hpe proliant xl675d gen10 plus server
- canonical/hpe proliant xl925 gen10 plus 1u 4-node configure-to-order server
- canonical/hpe storage file controller
- canonical/hpe storage performance file controller
- canonical/hpe storeeasy 1460 storage
- canonical/hpe storeeasy 1560 storage
- canonical/hpe storeeasy 1660 expanded storage
- canonical/hpe storeeasy 1660 performance storage
- canonical/hpe storeeasy 1860 performance storage