Products
| Product | |
| 1 | HPE Integrated Lights-Out 2 (iLO 2) |
| 2 | HPE Integrated Lights-Out 3 (iLO 3) |
| 3 | HPE Integrated Lights-Out 4 (iLO 4) |
CVE
CVE-2026-65204, CVE-2026-65205, CVE-2026-65206, CVE-2026-65207, CVE-2026-65208, CVE-2026-65209Executive summary #
HPE's iLO 2/3/4 RMCP+ implementation negotiates a session integrity algorithm during the RAKP handshake but does not require or verify an integrity code on inbound in-session packets. The receive path decides whether to authenticate a packet from that packet's own header bits rather than from the session's negotiated algorithms. An attacker who observes an active session ID can inject IPMI commands at that session's privilege without the account password or derived integrity or encryption keys.
This issue is an instance of CWE-924 (Improper Enforcement of Message Integrity During Transmission in a Communication Channel). It has an estimated CVSSv3.1 score of CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (8.8, High), and current SSVC vectors of "Exploitation: PoC" and "Technical Impact: Total."
Technical details #
The affected component is the iLO 2/3/4 RMCP+ session engine in elf.bin (src\ipmitrk.c and src\rmcpplus.c). The in-session receive path FUN_01ef2594 at 0x1ef2594 in iLO 4 firmware 2.82 resolves a session by the managed-system session ID and chooses processing from the arriving packet's payload-type byte. When the authentication bit 0x40 and encryption bit 0x80 are both clear, (pkt[1] & 0xc0) == 0, the cleartext branch dispatches the command on any active session without checking the negotiated integrity algorithm, verifying an integrity code, or applying the session sequence window. The same receive-path behavior is present in the iLO 2 and iLO 3 firmware branches, which share the same RMCP+ codebase.
To reproduce, establish an RMCP+ session that negotiates cipher suite 2, then send an in-session IPMI request using the assigned session ID with payload type 0x00, both protection bits clear, and no integrity trailer. A representative result on firmware 2.30 is:
suite-2 session mgd_sid=0x00c206af rakp1=0x00 rakp4=0x00
negotiated integrity=HMAC-SHA1-96
cleartext Get Device ID: cc=0x00
cleartext Set Session Privilege -> ADMIN: cc=0x00 data=04
cleartext Get User Name (slot 1): cc=0x00 data="Administrator"
session ID 0 control: no reply
The session-ID-zero control is dropped, confirming that the behavior targets an existing session rather than exposing a sessionless command path.
Attacker value #
An on-path attacker can impersonate an authenticated IPMI client by injecting commands into its active session without knowing the account password or session keys. If the victim session has Administrator privileges, the attacker can issue supported IPMI commands to power off or reset the managed server, modify user accounts, or change management-network settings. These actions are accepted under the victim session’s identity and privileges despite its negotiated integrity protection. Exploitation requires an existing authenticated session whose ID the attacker can observe.
Credit #
This issue was discovered by HD Moore with the help of AI tools. Disclosure was coordinated by Tod Beardsley.
Timeline #
- 2026-07-19: Initial findings discovered and documented
- 2026-07-21: CVE-2026-65205 reserved
- 2026-07-24: Vendor notified
- 2026-07-28: Transferred reserved CVE IDs to HPE for record management
- 2026-10-13: Public disclosure
