HPE iLO 6 (denial of service): An unauthenticated attacker on an adjacent network can knock out iLO 6 availability

Impact

An unauthenticated attacker on an adjacent network can knock out iLO 6 availability. No data is read or written - the damage is losing the out-of-band plane itself. For a GPU fleet that is a real operational hit rather than a cosmetic one: when iLO is down you cannot power-cycle a hung training node, cannot console into it to see why the job died, and cannot push firmware or re-provision it. A coordinated version of this against a rack turns a recoverable incident into a physical dispatch. Affects iLO 6 before v1.78, so it covers the Gen11 fleet.

Who can reach it

Adjacent network, unauthenticated - anything sharing the management segment with the iLOs. No account, no host access, no user interaction.

What to do

Flash iLO 6 to v1.78 or later. Out-of-band, per-node, no host reboot and no job drain - which makes this a cheap fix relative to the availability risk it removes. Because the vector is adjacent-network and unauthenticated, network segmentation is the meaningful compensating control while the rollout runs: keep BMCs off any segment shared with general-purpose hosts.

References