What’s Vulnerable › Vulnerabilities

CVE-2021-29209

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-05-25 · updated 2026-06-17
• Weakness: CWE-74

Description

A remote dom xss, crlf injection vulnerability was discovered in HPE Integrated Lights-Out 4 (iLO 4); HPE SimpliVity 380 Gen9; HPE Integrated Lights-Out 5 (iLO 5) for HPE Gen10 Servers; HPE SimpliVity 380 Gen10; HPE SimpliVity 2600; HPE SimpliVity 380 Gen10 G; HPE SimpliVity 325; HPE SimpliVity 380 Gen10 H version(s): Prior to version 2.78.

Affected products

• Hewlett Packard Enterprise Integrated Lights-Out 4: before 2.78 — fixed in 2.78
• HP Integrated Lights-Out 5: before 2.44 — fixed in 2.44

How to fix

Upgrade to a fixed version: Hewlett Packard Enterprise Integrated Lights-Out 4 2.78; HP Integrated Lights-Out 5 2.44. Check the vendor advisory for mitigations.

References

• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04134en_us
• https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf04134en_us

Get alerted when CVE-2021-29209 or the next vulnerability affects your stack