A potential security vulnerability has been identified with HP Integrated Lights-Out 4…
Priority LOW 36Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A potential security vulnerability has been identified with HP Integrated Lights-Out 4 (iLO 4) firmware version 2.11 and later, but prior to version 2.30. The vulnerability could be exploited remotely resulting in Denial of Service (DoS). Note this was originally published in 2015 however the CVE entry was added in 2020.
Why it matters now
EPSS 0.01614 76th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | HP Integrated Lights-Out 4 (iLO 4) | firmware version 2.11 and later, but prior to version 2.30 | — | No fix listed | CNA |
- HP Integrated Lights-Out 4 (iLO 4) Vendor— Affected firmware version 2.11 and later, but prior to version 2.30 Fixed in — No fix listed CNA
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:hp:integrated_lights-out_firmware:*:*:*:*:*:*:*:* | before 2.30 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:integrated_lights-out_4:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise |
- cpe:2.3:o:hp:integrated_lights-out_firmware:*:*:*:*:*:*:*:* Versions before 2.30 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:integrated_lights-out_4:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2015-5436
- 2026-10-03 Alias added: GHSA-2766-6fw4-8r99
More Hewlett Packard Enterprise Integrated Lights-out Firmware vulnerabilities
- TI-2013-04214 Unspecified vulnerability in HP Integrated Lights-Out 3 (aka iLO3) firmware before 1.60… CVSS 2.0HIGH 9.0
- TI-2013-04251 Unspecified vulnerability in HP Integrated Lights-Out 4 (iLO4) with firmware before 1.32… CVSS 2.0MEDIUM 6.8
- TI-2023-12671 A potential security vulnerability has been identified in HPE ProLiant RL300 Gen11 Server. CVSS 3.1MEDIUM 6.8
- TI-2004-00474 HP Integrated Lights-Out (iLO) 1.10 and other versions before 1.55 allows remote… CVSS 2.0MEDIUM 5.0
- TI-2013-04250 Cross-site scripting (XSS) vulnerability in HP Integrated Lights-Out 4 (iLO4) with… CVSS 2.0MEDIUM 4.3
Sources
- CVE-2015-5436 · CVE Program
- CVE-2015-5436 · NVD
- FIRST EPSS
- GHSA-2766-6fw4-8r99 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences