HPE · the BMC layer
PWX for iLO
HPE iLO (Integrated Lights-Out): the known vulnerabilities of its firmware, how to give a scanner read-only access, and the settings to check. Free, no account.
The BMC is one layer of PWX, which covers the stack from the tenant and its VMs to the host, BMC, CPU, GPU and TPU. See every layer
61 CVEs5 critical29 high0 exploited (KEV)
1. Known vulnerabilities
| CVE | Severity | Published | Summary |
|---|---|---|---|
| CVE-2026-79820 | critical 9 | 2026-10-05 | A remote user validation failure vulnerability exists in HPE Integrated Lights-Out (iLO) 7 firmware. |
| CVE-2026-63457 | medium 6.5 | 2026-08-05 | A potential denial of service vulnerability exists in HPE Integrated Lights-Out 6 (iLO 6) prior to v1.78. |
| CVE-2023-50272 | critical 9.8 | 2023-12-19 | A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 6 (iLO 6). The vulnerability could be remotely exploited to allow authentication bypass. |
| CVE-2023-30911 | high 7.5 | 2023-10-18 | HPE Integrated Lights-Out 5, and Integrated Lights-Out 6 using iLOrest may cause denial of service. |
| CVE-2023-28083 | medium 5.4 | 2023-03-22 | A remote Cross-site Scripting vulnerability was discovered in HPE Integrated Lights-Out 6 (iLO 6), Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 4 (iLO 4). HPE has provided software updates to resolve this... |
| CVE-2021-46846 | medium 6.1 | 2022-12-12 | Cross Site Scripting vulnerability in Hewlett Packard Enterprise Integrated Lights-Out 5. |
| CVE-2022-28640 | high 8.8 | 2022-09-20 | A potential local adjacent arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and availability was discovered in HPE Integrated Lights-Out 5 (iLO 5) in Version:... |
| CVE-2022-28639 | high 8.8 | 2022-09-20 | A remote potential adjacent denial of service (DoS) and potential adjacent arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and availability were discovered i... |
| CVE-2022-28638 | high 7.8 | 2022-09-20 | An isolated local disclosure of information and potential isolated local arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and availability were discovered in ... |
| CVE-2022-28637 | high 7.8 | 2022-09-20 | A local Denial of Service (DoS) and local arbitrary code execution vulnerability that could potentially lead to a loss of confidentiality, integrity, and availability were discovered in HPE Integrated Lights-Out 5 (iL... |
| CVE-2022-28636 | high 7.4 | 2022-08-12 | A potential local arbitrary code execution and a local denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unp... |
| CVE-2022-28635 | high 7.4 | 2022-08-12 | A potential local arbitrary code execution and a local denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unp... |
| CVE-2022-28634 | medium 6.7 | 2022-08-12 | A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. A highly privileged user could locally exploit this vulnerability to execute arb... |
| CVE-2022-28633 | high 7.3 | 2022-08-12 | A local disclosure of sensitive information and a local unauthorized data modification vulnerability were discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user coul... |
| CVE-2022-28632 | high 8.8 | 2022-08-12 | A potential arbitrary code execution and a denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged us... |
| CVE-2022-28631 | high 8.8 | 2022-08-12 | A potential arbitrary code execution and a denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged us... |
| CVE-2022-28630 | high 7.3 | 2022-08-12 | A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could locally exploit this vulnerability to execute arbitra... |
| CVE-2022-28629 | high 7.8 | 2022-08-12 | A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. A low privileged user could locally exploit this vulnerability to execute arbitr... |
| CVE-2022-28628 | high 8.4 | 2022-08-12 | A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could locally exploit this vulnerability to execute arbitra... |
| CVE-2022-28627 | high 8.4 | 2022-08-12 | A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user could locally exploit this vulnerability to execute arbitra... |
| CVE-2022-28626 | medium 6.7 | 2022-08-12 | A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. A highly privileged user could locally exploit this vulnerability to execute arb... |
| CVE-2022-23704 | high 7.5 | 2022-05-09 | A potential security vulnerability has been identified in Integrated Lights-Out 4 (iLO 4). The vulnerability could allow remote Denial of Service. The vulnerability is resolved in Integrated Lights-Out 4 (iLO 4) 2.80 ... |
| CVE-2022-23701 | medium 5.3 | 2022-02-24 | A potential remote host header injection security vulnerability has been identified in HPE Integrated Lights-Out 4 (iLO 4) firmware version(s): Prior to 2.60. This vulnerability could be remotely exploited to allow an... |
| CVE-2021-29211 | medium 4.8 | 2021-05-25 | A remote xss vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE ... |
| CVE-2021-29210 | medium 4.8 | 2021-05-25 | A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE S... |
Source: NVD, NVD CVE API 2.0: cpe:2.3:o:hpe:integrated_lights-out_6_firmware, cpe:2.3:o:hpe:integrated_lights-out_5_firmware, cpe:2.3:o:hp:integrated_lights-out_5_firmware, cpe:2.3:o:hpe:integrated_lights-out_4_firmware, keyword "Integrated Lights-Out", refreshed 2026-10-29 09:17 UTC. EXPLOITED = listed in the CISA KEV catalog.
2. Give a scanner read-only access
Role ReadOnly is the Login privilege only. iLO stores privileges, not roles: the RoleId it reports is the smallest role that covers the privileges assigned.
- Web interface (iLO 5 and iLO 6): Administration > User Administration > New. Login name, user name, password, role ReadOnly, Add User.
- iLOrest:
ilorest iloaccounts add pwx-ro pwx-ro <long random> --role ReadOnly - Redfish:
curl -sk -u admin -H 'Content-Type: application/json' -X POST https://<ilo>/redfish/v1/AccountService/Accounts/ \ -d '{"UserName":"pwx-ro","Password":"<long random>","RoleId":"ReadOnly"}'
Sources: HPE iLO 6 user administration · iLOrest iloaccounts · HPE: managing users over Redfish
3. Settings that open the power path
From the HPE Compute Security Reference Guide:
- IPMI/DCMI over LAN: Disabled (
NetworkProtocol IPMI.ProtocolEnabled = false). - SNMP: Disabled (
SNMP.ProtocolEnabled = false) unless needed. - Minimum password length 8 and password complexity on; authentication failure delay 10 s and logging on every failure; idle timeout 30 min.
- Require Host Authentication: Enabled (
Oem.Hpe.RequireHostAuthenticationon/redfish/v1/Managers/1/). - Security State at least High Security (
HpeSecurityService SecurityState). - A CA-signed certificate in place of the default self-signed one.
Sources: HPE Compute Security Reference Guide · HPE security service (Redfish)
Standard Redfish checks
| Redfish property | Want | Why |
|---|---|---|
| NetworkProtocol IPMI.ProtocolEnabled | false | IPMI 2.0 RAKP leaks password hashes to anyone who can reach the port (CVE-2013-4786). |
| NetworkProtocol Telnet.ProtocolEnabled | false | Credentials and commands travel in clear text. |
| NetworkProtocol HTTP.ProtocolEnabled | false | The web and Redfish interface is reachable without TLS. |
| NetworkProtocol SNMP.EnableSNMPv1 / EnableSNMPv2c | false (SNMPv3 only) | No authentication beyond a clear-text community string. |
| AccountService AccountLockoutThreshold | greater than 0 | With 0, BMC passwords can be guessed without limit. |
| HostInterface AuthenticationModes | no AuthNone | AuthNone lets any process on the host drive the BMC, and through it the power path, without credentials. |
| HostInterface CredentialBootstrapping.Enabled | false | The host OS can mint its own BMC account at any time. |
| Accounts with RoleId Administrator | one break-glass account | Each administrator can rewrite the power path. |
The Redfish Inspector checks each of these for you.
Vendor security advisories: support.hpe.com/connect/s/securitybulletinlibrary. New CVEs also appear in PWX news.
4. Check it
- One BMC, in your browser: collect its Redfish answers and paste them into the Redfish Inspector. On iLO the manager is usually
/redfish/v1/Managers/1. - All of them, from one machine that reaches the BMC network:
Every request is a GET and is written to a log next to the result. Nothing is sent anywhere else.curl -fsSL https://get.bareket.ai/pgdiscover | sh pgdiscover up 10.0.7.0/24 --credentials pwx-ro.cred --insecure - See what continuous monitoring adds: the Stack sandbox.
Free e-mail alerts
Get an e-mail when a new CVE lands for what you run
Run it on your own fleet
PWX Discover is free: the scan reads your fleet and lists what to fix, on your machine. PWX Monitor keeps watching every layer, from the tenant to the power rail, with attack paths and alerts in your SIEM. PWX Protect acts on the BMC. Start with a pilot.