Read the docs
TI-2022-07753 Aliases CVE-2022-23701GHSA-85g2-88cg-wg49

Injection in HPE Integrated Lights-Out 4

Priority LOW 25CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

A potential remote host header injection security vulnerability has been identified in HPE Integrated Lights-Out 4 (iLO 4) firmware version(s): Prior to 2.60. This vulnerability could be remotely exploited to allow an attacker to supply invalid input to the iLO 4 webserver, causing it to respond with a redirect to an attacker-controlled domain. HPE has provided a firmware update to resolve this vulnerability in HPE Integrated Lights-Out 4 (iLO 4).

Why it matters now

EPSS 0.00685 52nd percentileScored 2026-11-07
Fix Fixed HPE Integrated Lights-Out 4 (iLO 4): 2.60

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—HPE Integrated Lights-Out 4 (iLO 4)before 2.602.60Patch availableCNA
  • HPE Integrated Lights-Out 4 (iLO 4) Vendor— Affected before 2.60 Fixed in 2.60 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:hpe:integrated_lights-out:*:*:*:*:*:*:*:*before 2.60VulnerableHewlett Packard Enterprise (HPE)
cpe:2.3:h:hpe:integrated_lights-out_4:-:*:*:*:*:*:*:*not specified by NVDRunning onHewlett Packard Enterprise (HPE)

Remediation

  • Fix · CNA HPE Integrated Lights-Out 4 (iLO 4) Fixed in 2.60

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-23701
  2. 2026-10-03 Alias added: GHSA-85g2-88cg-wg49

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences