HPE iLO 4 / iLO 5 (unauthenticated information disclosure): An unauthenticated remote request pulls back the server

CVSS 5.3CVE-2020-7202Firmware, BMC & network fabricHPESBHF04069curated

Impact

An unauthenticated remote request pulls back the server serial number and other identifying detail from the iLO. Low impact on its own, high value as reconnaissance: it lets an attacker who can reach a management network enumerate exactly what hardware sits behind each iLO address, fingerprint generations, and pick which nodes are worth a real exploit - all without a single failed login to show up in an audit log. Covers ProLiant, Apollo, Synergy compute modules and Converged Systems, which is most of the HPE fleet shape a GPU operator would run.

Who can reach it

Anything routable to the iLO on the out-of-band management VLAN, unauthenticated. If any iLO is inadvertently internet-exposed, this is what a mass scanner harvests first.

What to do

Flash iLO 5 to v2.31 or later and iLO 4 to v2.76 or later. Out-of-band, per-node, no host reboot and no drain. Given the low direct impact, most operators should fold this into the next scheduled iLO firmware campaign rather than running a dedicated one - but do treat any internet-reachable iLO as an emergency independent of this CVE.

References

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04069en_us https://nvd.nist.gov/vuln/detail/CVE-2020-7202

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.