CVE-2018-7093 Denial of service in iLO 5 for HPE Gen10 Servers, iLO 4, iLO 3, Moonshot Chassis Management Firmware, Moonshot Component Packs for HPE ProLiant m510 and m710x server cartridges
Remote attackers can cause a denial of service in HPE iLO and Moonshot firmware, requiring firmware upgrades to mitigate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-7093?
CVE-2018-7093 is a high-severity denial of service vulnerability in Hewlett Packard Enterprise iLO 5 for HPE Gen10 Servers, iLO 4, iLO 3, Moonshot Chassis Management Firmware, Moonshot Component Packs for HPE ProLiant m510 and m710x server cartridges, published on 14 Aug 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A security vulnerability in HPE Integrated Lights-Out 3 prior to v1.90, iLO 4 prior to v2.60, iLO 5 prior to v1.30, Moonshot Chassis Manager firmware prior to v1.58, and Moonshot Component Pack prior to v2.55 could be remotely exploited to create a denial of service.
Which versions are affected by CVE-2018-7093?
It affects 5 products.
Products include Hp Integrated Lights-Out 3 Firmware, Hp Integrated Lights-Out 4 Firmware, Hp Integrated Lights-Out 5 Firmware, Hp Moonshot Chassis Manager Firmware, Hp Moonshot Component Pack Firmware.
How do I fix CVE-2018-7093?
No fix has been published for CVE-2018-7093 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2018-7093 being exploited?
There is no known exploitation of CVE-2018-7093 in the wild and no public exploit code.
Other vulnerabilities in Hewlett Packard Enterprise iLO 5 for HPE Gen10 Servers, iLO 4, iLO 3, Moonshot Chassis Management Firmware, Moonshot Component Packs for HPE ProLiant m510 and m710x server cartridges
- CVE-2013-2338 Code injection in n/a
- CVE-2016-4375 Information disclosure in n/a
- CVE-2012-3271 Information disclosure in n/a
- CVE-2017-8987 Denial of service in HPE Integrated Lights-Out 3 (iLO 3)
- CVE-2018-7105 Code injection in HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers, HPE Integrated Lights-Out 4 (iLO 4), HPE Integrated Lights-Out 3 (iLO 3)
Sources
Also known as GHSA-qf43-62jc-r476.