Information disclosure in Hewlett Packard Enterprise Integrated Lights-Out 4
Priority LOW 32CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- No fix listed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-200.
Summary
A remote disclosure of information vulnerability in Moonshot Remote Console Administrator Prior to 2.50, iLO4 prior to v2.53, iLO3 prior to v1.89 and iLO2 prior to v2.30 was found.
Why it matters now
EPSS 0.01447 73rd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Hewlett Packard Enterprise | Integrated Lights-Out 4 | Moonshot Remote Console Administrator Prior to 2.50, iLO4 prior to v2.53, iLO3 prior to v1.89 and iLO2 prior to v2.30 | — | No fix listed | CNA |
- Integrated Lights-Out 4 VendorHewlett Packard Enterprise Affected Moonshot Remote Console Administrator Prior to 2.50, iLO4 prior to v2.53, iLO3 prior to v1.89 and iLO2 prior to v2.30 Fixed in — No fix listed CNA
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:hp:moonshot_remote_console_administrator:*:*:*:*:*:*:*:* | before 2.50 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:integrated_lights-out_2_firmware:*:*:*:*:*:*:*:* | before 2.30 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:integrated_lights-out_3_firmware:*:*:*:*:*:*:*:* | before 1.89 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:o:hp:integrated_lights-out_4_firmware:*:*:*:*:*:*:*:* | before 2.53 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:integrated_lights-out:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise |
- cpe:2.3:a:hp:moonshot_remote_console_administrator:*:*:*:*:*:*:*:* Versions before 2.50 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:integrated_lights-out_2_firmware:*:*:*:*:*:*:*:* Versions before 2.30 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:integrated_lights-out_3_firmware:*:*:*:*:*:*:*:* Versions before 1.89 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:o:hp:integrated_lights-out_4_firmware:*:*:*:*:*:*:*:* Versions before 2.53 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:integrated_lights-out:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2017-12543
- 2026-10-03 Alias added: GHSA-qwh9-2cm6-p4rq
References
More Hewlett Packard Enterprise Integrated Lights-out 2 Firmware vulnerabilities
- TI-2014-06544 Unspecified vulnerability in HP Integrated Lights-Out (iLO) firmware 2 before 2.27 and 4… CVSS 2.0HIGH 10.0
- TI-2017-06471 Security vulnerabilities in the HPE Integrated Lights-Out 2 (iLO 2) firmware could be… CVSS 3.0CRITICAL 9.8
- TI-2014-02084 The server in HP Integrated Lights-Out 2 (aka iLO 2) 2.23 and earlier allows remote… CVSS 2.0HIGH 7.8
- TI-2015-01890 Unspecified vulnerability in HP Integrated Lights-Out (iLO) firmware 2 before 2.27, 3… CVSS 2.0MEDIUM 6.4
- TI-2018-05169 The HPE-provided Windows firmware installer for certain Gen9, Gen8, G7,and G6 HPE servers… CVSS 3.0MEDIUM 5.5
Sources
- CVE-2017-12543 · CVE Program
- CVE-2017-12543 · NVD
- FIRST EPSS
- GHSA-qwh9-2cm6-p4rq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences