HPE iLO 5 (adjacent-network code execution / DoS): Arbitrary code execution on the iLO from an adjacent network

CVSS 8.8CVE-2022-28639Firmware, BMC & network fabricHPESBHF04365curated

Impact

Arbitrary code execution on the iLO from an adjacent network position, with denial of service as the softer outcome. Code execution on the service processor means the attacker owns power, Virtual Media, console and firmware for that node, and can leave an implant that outlives any host reinstall. The DoS variant is its own operational problem on a GPU fleet: losing iLO means losing the only way to power-cycle or console into a wedged training node, so an outage turns into a truck roll.

Who can reach it

Adjacent network - an attacker already on the same management segment as the iLO. That is a compromised jump host, a monitoring collector, another node's BMC, or anything else sharing the OOB VLAN. Not internet-reachable by design, but flat management networks make 'adjacent' mean 'the entire datacenter'.

What to do

Flash iLO 5 to v2.72 or later (v2.71 and earlier are affected). Out-of-band, per-node, no host reboot and no job drain. The durable control is segmentation: this class of bug is only exploitable from the management network, so the value of putting each rack's BMCs behind their own segment with an explicit allowlist is high and it is a network change rather than a per-node campaign.

References

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04365en_us https://nvd.nist.gov/vuln/detail/CVE-2022-28639

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.