CVE-2016-4406

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-08-06 · updated 2026-06-17
Weakness: CWE-79

Description

A remote cross site scripting vulnerability was identified in HPE iLO 3 all version prior to v1.88 and HPE iLO 4 all versions prior to v2.44.

Affected products

Hewlett Packard Enterprise HPE Integrated Lights-Out 3 (iLO 3): before 1.88 — fixed in 1.88
Hewlett Packard Enterprise Integrated Lights-out 4 (iLO 4): before 2.44 — fixed in 2.44

How to fix

Upgrade to a fixed version: Hewlett Packard Enterprise HPE Integrated Lights-Out 3 (iLO 3) 1.88; Hewlett Packard Enterprise Integrated Lights-out 4 (iLO 4) 2.44. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/94426
http://www.securitytracker.com/id/1037318
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05337025
http://www.securityfocus.com/bid/94426
http://www.securitytracker.com/id/1037318
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c05337025

Get alerted when CVE-2016-4406 or the next vulnerability affects your stack