HPE iLO 4 / iLO 5 (unauthenticated information disclosure): An unauthenticated remote request pulls back the server

Impact

An unauthenticated remote request pulls back the server serial number and other identifying detail from the iLO. Low impact on its own, high value as reconnaissance: it lets an attacker who can reach a management network enumerate exactly what hardware sits behind each iLO address, fingerprint generations, and pick which nodes are worth a real exploit - all without a single failed login to show up in an audit log. Covers ProLiant, Apollo, Synergy compute modules and Converged Systems, which is most of the HPE fleet shape a GPU operator would run.

Who can reach it

Anything routable to the iLO on the out-of-band management VLAN, unauthenticated. If any iLO is inadvertently internet-exposed, this is what a mass scanner harvests first.

What to do

Flash iLO 5 to v2.31 or later and iLO 4 to v2.76 or later. Out-of-band, per-node, no host reboot and no drain. Given the low direct impact, most operators should fold this into the next scheduled iLO firmware campaign rather than running a dedicated one - but do treat any internet-reachable iLO as an emergency independent of this CVE.

References