HPE iLO 7: remote user validation failure allows unauthenticated compromise of the management controller

Impact

A validation failure in iLO 7 lets a remote actor bypass user validation on the out-of-band management controller, with HPE scoring full confidentiality, integrity and availability loss and a scope change beyond the iLO itself. On a GPU host the BMC is the console, the virtual media path, the power control and the firmware update channel, so control of it means control of the node below the operating system - including re-imaging it or mounting virtual media regardless of what the tenant OS enforces. Because iLO sits on the management VLAN that typically spans the whole fleet, one reachable controller is a foothold against every node on that network. HPE's advisory text in this record is a single sentence; the precise flaw and the exact affected firmware versions are only in the HPE bulletin.

Who can reach it

Network-reachable iLO 7 management interface, no authentication required (AV:N/PR:N), though HPE rates attack complexity high. In practice this means anyone who can reach the management VLAN, including a tenant or workload that has been given a route to it.

What to do

Apply the iLO 7 firmware update named in HPE bulletin hpesbhf05163en_us. The record does not state the fixed firmware version, so take it from the bulletin. iLO firmware updates can usually be staged with the host running and activate on an iLO reset, but plan for a management-plane outage per node and verify the running version afterwards. Until then, confirm iLO interfaces are on an isolated management network with no tenant or internet reachability.

References

Related entries

• Arista EOS OSPFv3: crafted packet restarts the routing agentCVE-2026-73455 · Arista EOS (OSPFv3 routing agent)High
• Linux kernel InfiniBand uverbs (ib_uverbs / ib_umem_get, drivers/infiniband/core/umem.c): The canonical RDMA isolationCVE-2014-8159 · Linux kernel InfiniBand uverbs (ib_uverbs / ib_umem_get, drivers/infiniband/core/umem.c)High
• Dell iDRAC7 / iDRAC8 firmware before 2.40.40.40 - racadm CLI string injection: A string injection escapes theCVE-2016-5685 · Dell iDRAC7 / iDRAC8 firmware before 2.40.40.40 - racadm CLI string injectionHigh
• Cisco NX-OS / FXOS (LLDP parser): A malformed LLDP frame reloads the switch. LLDP is enabled by default on essentiallyCVE-2018-0395 · Cisco NX-OS / FXOS (LLDP parser)High
• Dell iDRAC7 / iDRAC8 / iDRAC9 (SNMP agent): Command injection in the iDRAC SNMP agent gives an attacker who alreadyCVE-2018-1244 · Dell iDRAC7 / iDRAC8 / iDRAC9 (SNMP agent)High
• Dell iDRAC9 (Redfish): Redfish interface permission-check flaw enabling privilege escalation to adminCVE-2018-15774 · Dell iDRAC9 (Redfish)High