CVE-2021-29202 : A local buffer overflow vulnerability was discovered in HPE Integrated Lights-Ou

A local buffer overflow vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.

Published 2021-05-25 14:15:08

Updated 2021-06-02 20:24:13

Source Hewlett Packard Enterprise (HPE)

View at NVD, CVE.org

Vulnerability category: Overflow

Products affected by CVE-2021-29202

HP » Integrated Lights-out 4
Versions before (<) 2.78
cpe:2.3:o:hp:integrated_lights-out_4:*:*:*:*:*:*:*:*
Matching versions
When used together with: HP » Simplivity 380 Gen9 » Version: N/A
HP » Integrated Lights-out 5
Versions before (<) 2.44
cpe:2.3:o:hp:integrated_lights-out_5:*:*:*:*:*:*:*:*
Matching versions
When used together with: HP » Proliant Bl460c Gen10 Server Blade » Version: N/A
When used together with: HP » Proliant Dl120 Gen10 Server » Version: N/A
When used together with: HP » Proliant Dl160 Gen10 Server » Version: N/A
When used together with: HP » Proliant Dl180 Gen10 Server » Version: N/A
When used together with: HP » Proliant Dl20 Gen10 Server » Version: N/A
When used together with: HP » Proliant Dl325 Gen10 Plus Server » Version: N/A
When used together with: HP » Proliant Dl325 Gen10 Server » Version: N/A
When used together with: HP » Proliant Dl360 Gen10 Server » Version: N/A
When used together with: HP » Proliant Dl380 Gen10 Server » Version: N/A
When used together with: HP » Proliant Dl385 Gen10 Plus Server » Version: N/A
When used together with: HP » Proliant Dl385 Gen10 Server » Version: N/A
When used together with: HP » Proliant Dl560 Gen10 Server » Version: N/A
When used together with: HP » Proliant Dl580 Gen10 Server » Version: N/A
When used together with: HP » Proliant Ml110 Gen10 Server » Version: N/A
When used together with: HP » Proliant Ml30 Gen10 Server » Version: N/A
When used together with: HP » Proliant Ml350 Gen10 Server » Version: N/A
When used together with: HP » Proliant Xl170r Gen10 Server » Version: N/A
When used together with: HP » Proliant Xl190r Gen10 Server » Version: N/A
When used together with: HP » Proliant Xl230k Gen10 Server » Version: N/A
When used together with: HP » Proliant Xl270d Gen10 Server » Version: N/A
When used together with: HP » Proliant Xl450 Gen10 Server » Version: N/A
When used together with: HP » Simplivity 2600 » Version: N/A
When used together with: HP » Simplivity 325 » Version: N/A
When used together with: HP » Simplivity 380 Gen10 » Version: N/A
When used together with: HP » Simplivity 380 Gen10 G » Version: N/A
When used together with: HP » Simplivity 380 Gen10 H » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2021-29202

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 18 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2021-29202

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.6	MEDIUM	AV:L/AC:L/Au:N/C:P/I:P/A:P	3.9	6.4	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
6.7	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	0.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2021-29202

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2021-29202

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04134en_us

HPESBHF04134 rev.1 - HPE SimpliVity using HPE Integrated Lights-Out 5 (iLO 5) and HPE Integrated Lights-Out 4 (iLO 4), Multiple Remote and Local Vulnerabilities
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2021-29202

Products affected by CVE-2021-29202

Exploit prediction scoring system (EPSS) score for CVE-2021-29202

CVSS scores for CVE-2021-29202

CWE ids for CVE-2021-29202

References for CVE-2021-29202