CVE-2023-50272 Auth bypass in HPE Integrated Lights-out 5 (iLO 5), HPE Integrated Lights-out 6 (iLO 6),

High 7.5 Published 19 Dec 2023 Updated 7 May 2025

Remote attackers can bypass authentication in HPE iLO 5 and 6 firmware, gaining unauthorized access to server management interfaces.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-50272?

CVE-2023-50272 is a high-severity authentication bypass vulnerability in Hewlett Packard Enterprise (HPE) HPE Integrated Lights-out 5 (iLO 5), HPE Integrated Lights-out 6 (iLO 6), , published on 19 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 6 (iLO 6). The vulnerability could be remotely exploited to allow authentication bypass.

Weakness: CWE-288

Which versions are affected by CVE-2023-50272?

It affects 2 products.

Products include Hpe Integrated Lights-Out 5 Firmware, Hpe Integrated Lights-Out 6 Firmware.

How do I fix CVE-2023-50272?

No fix has been published for CVE-2023-50272 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2023-50272 being exploited?

There is no known exploitation of CVE-2023-50272 in the wild and no public exploit code.

Sources

Also known as GHSA-42rj-c8ww-p58f.