CVE-2022-23704: HP Integrated Lights-Out 4 DoS Vulnerability

CVE-2022-23704 Overview

A security vulnerability has been identified in HPE Integrated Lights-Out 4 (iLO 4), a remote server management processor embedded in HPE ProLiant and Synergy servers. This vulnerability enables remote attackers to cause a Denial of Service (DoS) condition against the iLO 4 management interface without requiring authentication. The iLO 4 firmware is a critical out-of-band management component that provides hardware-level access for system monitoring, remote console access, and server power control, making this vulnerability particularly impactful in enterprise data center environments.

Critical Impact

Remote attackers can disrupt server management capabilities across extensive HPE ProLiant Gen8/Gen9 and Synergy infrastructure, potentially preventing administrators from remotely monitoring, managing, or recovering affected systems.

Affected Products

• HP Integrated Lights-Out 4 (iLO 4) firmware versions prior to 2.80
• HPE ProLiant Gen8 Server Series (DL, ML, BL, SL, WS, XL product lines)
• HPE ProLiant Gen9 Server Series (DL, ML, BL, XL product lines)
• HPE Synergy Gen9 Compute Modules (480, 620, 660, 680)
• HPE Apollo 4200 Gen9 Server

Discovery Timeline

• May 9, 2022 - CVE-2022-23704 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2022-23704

Vulnerability Analysis

This vulnerability resides in the HPE Integrated Lights-Out 4 (iLO 4) firmware, which provides out-of-band management capabilities for HPE server hardware. The iLO subsystem operates independently of the host operating system on a dedicated ARM processor, handling critical functions such as remote console access, power management, hardware monitoring, and system recovery operations.

The vulnerability allows a remote attacker to cause a Denial of Service condition against the iLO 4 management interface. When exploited, this can render the out-of-band management functionality unavailable, preventing administrators from accessing remote console sessions, monitoring hardware health, or performing power operations through the iLO interface.

The attack can be executed over the network without requiring any prior authentication or user interaction, making it exploitable from anywhere with network access to the iLO management interface. While the vulnerability does not compromise the confidentiality or integrity of the system, the availability impact is significant given the critical role iLO plays in enterprise server management.

Root Cause

The specific technical root cause has not been publicly disclosed by HPE. However, the vulnerability characteristics indicate an issue in the iLO 4 firmware's network service handling that can be triggered remotely to exhaust resources or crash the management processor. The CWE classification indicates insufficient information is available to determine the precise weakness category, though the network-accessible DoS behavior suggests potential issues with input validation, resource management, or exception handling in the iLO 4 web or management services.

Attack Vector

The attack is network-based and can be executed remotely against the iLO 4 management interface. Attackers do not require authentication credentials or user interaction to trigger the vulnerability. The attack targets the dedicated iLO network interface, which is typically configured on a separate management network or VLAN in enterprise environments. Organizations that expose iLO interfaces to untrusted networks or the internet are at heightened risk.

The impact is limited to availability—the attacker cannot read sensitive data or modify system configurations through this vulnerability. However, loss of iLO availability can significantly impact operational capabilities, particularly in environments that rely on out-of-band management for remote administration, automated monitoring, or disaster recovery procedures.

Detection Methods for CVE-2022-23704

Indicators of Compromise

• Unexpected iLO 4 interface unavailability or unresponsiveness
• iLO management processor resets or reboots without administrative action
• Unusual network traffic patterns targeting iLO management ports (typically HTTPS on port 443)
• Increased connection attempts or anomalous requests to iLO web services
• iLO event logs showing service interruptions or unexpected restarts

Detection Strategies

• Monitor iLO service availability using network-based health checks and alerting systems
• Implement network intrusion detection rules for anomalous traffic patterns targeting iLO management interfaces
• Review iLO Integrated Management Logs (IML) for unexpected service interruptions or processor resets
• Deploy honeypots or network sensors on management VLANs to detect reconnaissance and exploitation attempts

Monitoring Recommendations

• Configure SNMP traps or email alerts for iLO availability changes and system events
• Establish baseline network traffic patterns for iLO interfaces and alert on significant deviations
• Centralize iLO logs using HPE Remote Support or third-party SIEM solutions for correlation analysis
• Regularly audit network segmentation to ensure iLO interfaces are not exposed to untrusted networks

How to Mitigate CVE-2022-23704

Immediate Actions Required

• Upgrade iLO 4 firmware to version 2.80 or later on all affected HPE ProLiant and Synergy systems
• Implement network segmentation to isolate iLO management interfaces from untrusted networks
• Apply firewall rules to restrict access to iLO interfaces to authorized management systems only
• Review and disable unnecessary iLO services and protocols to reduce the attack surface

Patch Information

HPE has resolved this vulnerability in Integrated Lights-Out 4 (iLO 4) firmware version 2.80 and later. Administrators should download the latest iLO 4 firmware from the HPE Support Document or through the HPE Support Center. The firmware update can be applied through the iLO web interface, HPE Smart Update Manager (SUM), or HPE OneView for environments with centralized management.

Workarounds

• Place iLO interfaces on dedicated management VLANs with strict access controls
• Implement firewall rules to allow iLO access only from trusted administrative IP addresses or jump hosts
• Consider disabling web interface access and using SSH-based command line interface where feasible
• Enable iLO login security features including IP address restrictions and login delay settings

# Example firewall rule to restrict iLO access (iptables)
# Allow only trusted management network to access iLO interface
iptables -A INPUT -p tcp --dport 443 -s 10.0.10.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP

# Verify iLO firmware version via SSH (requires iLO SSH access enabled)
# ssh administrator@ilo-ip
# show /map1/firmware1