CVE-2013-2338

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 10.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-06-14 · updated 2026-06-16

Description

Unspecified vulnerability on HP Integrated Lights-Out 3 (aka iLO3) cards with firmware before 1.57 and 4 (aka iLO4) cards with firmware before 1.22, when Single-Sign-On (SSO) is used, allows remote attackers to execute arbitrary code via unknown vectors.

Affected products

Hewlett Packard Enterprise HPE Integrated Lights-Out 3 (iLO 3): through 1.55; 1.00, 1.05, 1.20, 1.26, 1.28, 1.50
Hewlett Packard Enterprise Integrated Lights-out 4 (iLO 4): through 1.20; 1.11, 1.13

References

https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03787836
https://h20564.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c03787836

Get alerted when CVE-2013-2338 or the next vulnerability affects your stack