A authentication bypass and execution of code vulnerability in HPE Integrated Lights-out 4 (iLO 4) version prior to 2.53 was found.
Published 2018-02-15 22:29:04
Updated 2018-07-23 13:05:29
View at NVD,   CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2017-12542

97.24%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2017-12542

  • HP iLO 4 1.00-2.50 Authentication Bypass Administrator Account Creation
    Disclosure Date: 2017-08-24
    First seen: 2020-04-26
    auxiliary/admin/hp/hp_ilo_create_admin_account
    This module exploits an authentication bypass in HP iLO 4 1.00 to 2.50, triggered by a buffer overflow in the Connection HTTP header handling by the web server. Exploiting this vulnerability gives full access to the REST API, allowing arbitrary accounts creation.

CVSS scores for CVE-2017-12542

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
10.0
HIGH AV:N/AC:L/Au:N/C:C/I:C/A:C
10.0
10.0
NIST
10.0
CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
3.9
6.0
NIST

References for CVE-2017-12542

Products affected by CVE-2017-12542

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!