HPE ProLiant RL300 Gen11 (UEFI firmware, out-of-bounds read): Out-of-bounds reads in the UEFI firmware of the ProLiant

Impact

Out-of-bounds reads in the UEFI firmware of the ProLiant RL300 Gen11 - HPE's Arm-based (Ampere) ProLiant. The CVSS vector marks scope as changed with high confidentiality impact, meaning the leak crosses a trust boundary out of the firmware context. Firmware-level memory disclosure is how an attacker recovers the addresses and secrets that make a subsequent firmware write reliable, so treat it as an enabler for a persistence attack rather than as a standalone data-loss event. Relevant to operators running mixed-architecture racks where Arm nodes handle inference or control-plane duty alongside x86 GPU boxes.

Who can reach it

Local to the host with high privileges - a root/administrator account on the operating system. Not remotely reachable and not exposed on the management VLAN.

What to do

UEFI firmware update on the affected RL300 Gen11 nodes. As with any system firmware, it applies on the next reboot, so it costs a maintenance window per node rather than a live out-of-band flash. Small affected footprint means the campaign should be quick to scope - identify RL300 Gen11 nodes specifically, since the rest of the ProLiant Gen11 line is not in scope. No config-only mitigation.

References

Related entries

• NVIDIA DGX Spark: out-of-bounds read in standalone MM firmware discloses information across a scope boundaryCVE-2026-24225 · NVIDIA DGX Spark (standalone MM firmware)Medium
• NVIDIA DGX Spark: UEFI administrator password protection can be bypassed by a privileged local userCVE-2026-47624 · NVIDIA DGX Spark (UEFI administrator password protection)Medium
• Arista EOS: gNPSI client credentials can be written in clear text to accounting logsCVE-2026-73457 · Arista EOS gNPSI (client credentials in accounting logs)Medium
• Arista EOS: gNSI authz policy rotation can fail silently, leaving revoked gRPC access in placeCVE-2026-73463 · Arista EOS gNSI Authz service (policy rotation race with multiple gNSI transports)Medium
• Arista EOS: private keys, user passwords and TACACS+ secrets logged in cleartext when debug tracing is onCVE-2026-73465 · Arista EOS logging (secrets written in cleartext under non-standard debug trace levels)Medium
• Infineon TPM firmware (RSA key generation): RSA keys generated inside affected Infineon TPMs are factorableCVE-2017-15361 · Infineon TPM firmware (RSA key generation)Medium