HPE iLO 5 / iLO 6 (authentication bypass): Authentication bypass on the iLO itself, remotely, with no credentials

Impact

Authentication bypass on the iLO itself, remotely, with no credentials. That is the whole out-of-band plane on a ProLiant or Apollo node: power control, Virtual Media to boot an attacker-supplied image, remote console into the tenant's session, and a firmware-level foothold that persists through host reimaging. The CVSS vector marks scope as changed, which reflects exactly that - getting the BMC gets you more than the BMC. Affects iLO 5 from v2.63 up to (not including) v3.00, and iLO 6 from v1.05 up to v1.55, so it spans both the Gen10/Gen10 Plus and Gen11 fleets.

Who can reach it

Anything routable to the iLO address on the out-of-band management VLAN, unauthenticated. Attack complexity is rated high, so it is not a trivial one-shot, but it requires no account and no host access - the exposure is defined purely by who can reach the iLO.

What to do

Flash iLO 5 to v3.00 or later, iLO 6 to v1.55 or later. Out-of-band, per-node, via the iLO web UI, iLOrest, Redfish or OneView - no host reboot and no drain of running jobs; the iLO resets itself and OOB access is unavailable for a couple of minutes. Interim config-only control: restrict the iLO management network to an explicit allowlist of jump hosts, since there is no per-feature toggle that closes an authentication bypass.

References