CVE-2022-28638: Infoleak

Q: What is the severity of CVE-2022-28638?

The severity of CVE-2022-28638 is classified as high due to its potential for local information disclosure and arbitrary code execution.

Q: How do I fix CVE-2022-28638?

To fix CVE-2022-28638, upgrade the HPE Integrated Lights-Out 5 firmware to version 2.72 or later.

Q: What devices are affected by CVE-2022-28638?

CVE-2022-28638 affects the HPE Integrated Lights-Out 5 firmware up to version 2.71.

Q: What impact does CVE-2022-28638 have on systems?

CVE-2022-28638 can lead to a loss of confidentiality, integrity, and availability in affected systems.

Q: Is there a workaround for CVE-2022-28638?

There are no known workarounds for CVE-2022-28638; updating the firmware is recommended for mitigation.

Published Sep 20, 2022

Updated

An isolated local disclosure of information and potential isolated local arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and availability were discovered in HPE Integrated Lights-Out 5 (iLO 5) in Version: 2.71. Hewlett Packard Enterprise has provided updated firmware for HPE Integrated Lights-Out 5 (iLO 5) that addresses these security vulnerabilities.

Affected Software

154 affected components

HPE Integrated Lights-out 5 Firmware<2.72

HP Apollo 4200 Gen10 Server

HP Apollo 4500

HP Apollo R2000 Chassis

HPE Apollo 2000 Gen10 Plus System

HPE Apollo 4200 Gen10 Plus System

HPE Apollo 4510 Gen10 System

HPE Apollo 6500 Gen10 Plus

HPE Apollo N2600 Gen10 Plus

HPE Apollo N2800 Gen10 Plus

HPE Apollo R2600 Gen10

HPE Apollo R2800 Gen10

HPE Edgeline E920 Server Blade

HPE Edgeline E920d Server Blade

HPE Edgeline E920t Server Blade

HPE Integrated Lights-Out 5

HPE Proliant Bl460c Gen10 Server Blade

HPE Proliant Dl110 Gen10 Plus Telco Server

HPE Proliant Dl160 Gen10 Server

HPE Proliant Dl180 Gen10 Server

HPE Proliant Dl20 Gen10 Plus Server

HPE Proliant Dl20 Gen10 Server

HPE Proliant Dl325 Gen10 Plus Server

HPE Proliant Dl325 Gen10 Plus V2 Server

HPE Proliant Dl325 Gen10 Server

HPE Proliant Dl345 Gen10 Plus Server

HPE Proliant Dl360 Gen10 Plus Server

HPE Proliant Dl360 Gen10 Server

HPE Proliant Dl365 Gen10 Plus Server

HPE Proliant Dl380 Gen10 Plus Server

HPE Proliant Dl380 Gen10 Server

HPE Proliant Dl385 Gen10 Plus Server

HPE Proliant Dl385 Gen10 Plus V2 Server

HPE Proliant Dl385 Gen10 Server

HPE Proliant Dl560 Gen10 Server

HPE Proliant Dl580 Gen10 Server

HPE Proliant Dx170r Gen10 Server

HPE Proliant Dx190r Gen10 Server

HPE Proliant Dx220n Gen10 Plus Server

HPE Proliant Dx325 Gen10 Plus V2 Server

HPE Proliant Dx360 Gen10 Plus Server

HPE Proliant Dx360 Gen10 Server

HPE Proliant Dx380 Gen10 Plus Server

HPE Proliant Dx380 Gen10 Server

HPE Proliant Dx385 Gen10 Plus Server

HPE Proliant Dx385 Gen10 Plus V2 Server

HPE Proliant Dx4200 Gen10 Server

HPE Proliant Dx560 Gen10 Server

HPE Proliant E910 Server Blade

HPE Proliant E910t Server Blade

HPE Proliant M750 Server Blade

HPE ProLiant MicroServer Gen10 Plus

HPE Proliant Ml110 Gen10 Server

HPE Proliant Ml30 Gen10 Plus Server

HPE Proliant Ml30 Gen10 Server

HPE Proliant Ml350 Gen10 Server

HPE Proliant Xl170r Gen10 Server

HPE Proliant Xl190r Gen10 Server

HPE Proliant Xl220n Gen10 Plus Server

HPE Proliant Xl225n Gen10 Plus 1u Node

HPE Proliant Xl230k Gen10 Server

HPE Proliant Xl270d Gen10 Server

HPE Proliant Xl290n Gen10 Plus Server

HPE Proliant Xl420 Gen10 Server

HPE Proliant Xl450 Gen10 Server

HPE Proliant Xl645d Gen10 Plus Server

HPE Proliant Xl675d Gen10 Plus Server

HPE Proliant Xl925g Gen10 Plus 1u 4-node Configure-to-order Server

HPE Storage File Controller

HPE Storage Performance File Controller

HPE Storeeasy 1460 Storage

HPE Storeeasy 1560 Storage

HPE Storeeasy 1660 Expanded Storage

HPE Storeeasy 1660 Performance Storage

HPE Storeeasy 1660 Storage

HPE Storeeasy 1860 Performance Storage

HPE Storeeasy 1860 Storage

All of the following