CVE-2021-29202 Memory corruption in HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers
A local buffer overflow in HPE iLO firmware allows attackers to execute arbitrary code or escalate privileges on affected servers.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-29202?
CVE-2021-29202 is a medium-severity memory corruption vulnerability in HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers, published on 25 May 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A local buffer overflow vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.
Weakness: CWE-120
Which versions are affected by CVE-2021-29202?
It affects 2 products.
Products include Hp Integrated Lights-Out 4, Hp Integrated Lights-Out 5.
How do I fix CVE-2021-29202?
No fix has been published for CVE-2021-29202 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2021-29202 being exploited?
There is no known exploitation of CVE-2021-29202 in the wild and no public exploit code.
Other vulnerabilities in HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers
- CVE-2023-28083 Cross-site scripting in Integrated Lights-Out
- CVE-2022-23704 A potential security vulnerability has been identified in Integrated Lights-Out 4 (iLO 4).
- CVE-2013-4843 Information disclosure in n/a
- CVE-2020-7202 Information disclosure in HPE ProLiant Servers, Apollo Products, Converged Systems, and Synergy Compute Modules with Integrated Lights-Out 5 (iLO 5), or Integrated Lights-Out 4 (iLO 4)
- CVE-2021-29201 Cross-site scripting in HPE Integrated Lights-Out 4 (iLO 4) For HPE Gen9 servers; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers
Sources
Also known as GHSA-327f-g4v5-jjvp.