CVE-2026-63457

Executive Summary

CVE-2026-63457 is a denial of service (DoS) vulnerability in HPE Integrated Lights-Out 6 (iLO 6) firmware versions prior to v1.78. An unauthenticated attacker with network adjacency can exploit this flaw to crash the management controller, resulting in a loss of remote management and monitoring capabilities for affected HPE servers. With a CVSS score of 6.5 (Medium), this vulnerability does not compromise confidentiality or integrity, but the availability impact is rated as High, making it a significant operational concern for data center environments relying on iLO 6 for out-of-band management.

Technical Analysis

The HPE iLO 6 is a dedicated server management processor that provides out-of-band (OOB) management capabilities, including remote console access, virtual media mounting, power control, health monitoring, and firmware updates. Because iLO runs independently of the host operating system, it exposes its own network services (typically over dedicated management ports or shared NICs) and is frequently accessible on separate VLANs or management networks.

The vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption), indicating that the flaw stems from improper handling of resource exhaustion conditions. Based on the CVSS vector CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C:N/I:N/A:H, the following characteristics are observable:

• Attack Vector: Adjacent (AV:A) — The attacker must be on the same Layer 2 network segment or have access to a directly connected management network. This excludes typical Internet-exposed exploitation but includes compromised adjacent hosts, rogue devices plugged into management switches, or attackers who have already breached the management VLAN.
• Attack Complexity: Low (AC:L) — No special conditions or race conditions are needed to trigger the flaw.
• Privileges Required: None (PR:N) — The attacker does not need any authentication credentials or prior access to the iLO interface.
• User Interaction: None (UI:N) — The attack can be executed entirely without victim interaction.
• Scope: Unchanged (S:U) — The compromised component and the affected security impact are confined to the iLO subsystem itself; the host operating system is not considered within scope.
• Availability Impact: High (A:H) — Successful exploitation results in a complete denial of service of the iLO management processor.

While the vendor did not publish the specific technical root cause in the initial advisory, the CWE-400 classification strongly suggests one of several common attack vectors:

1. Uncontrolled Resource Consumption via Network Traffic: A crafted sequence of network packets — possibly malformed HTTP/HTTPS requests to the iLO web interface, or specially malformed IPMI (Intelligent Platform Management Interface) packets — could cause unbounded memory allocation or CPU spin within the firmware's network stack.
2. Packet Flooding with State Exhaustion: Given the adjacency requirement, a simple ARP/NDP flood or a sustained burst of TCP SYN packets to the iLO's listening ports could exhaust protocol state tables, eventually rendering the management processor unresponsive.
3. Malformed Protocol Payloads: iLO 6 supports multiple management protocols (HTTPS, SSH, IPMI, REST API, Redfish). A malformed request to any of these services could trigger an unhandled exception in the firmware's parsing logic, causing a crash or watchdog timeout.

The result of exploitation is typically a reboot of the management processor or a hang requiring physical intervention. During the downtime, administrators lose the ability to remotely manage the server, monitor hardware health sensors, or perform power cycling — severely hampering incident response and routine maintenance operations.

Exploitation Scenarios

Scenario 1: Malformed HTTPS Request Flood Against the Web Interface

1. Reconnaissance: The attacker identifies the management network segment (e.g., 10.0.10.0/24) using passive network sniffing or active ARP scans. The attacker scans for TCP port 443 on the subnet to locate iLO 6 interfaces. A banner grab reveals "Integrated Lights-Out 6" in the HTTP response headers.
2. Weaponization: Using a tool such as scapy or a custom Python script, the attacker crafts a series of HTTP/1.1 GET requests with malformed header fields (e.g., excessively long Host: values, invalid Content-Length headers, or garbage data following the \r\n\r\n terminator). The requests are sent rapidly over a persistent TCP connection.
3. Trigger: The iLO firmware's HTTP parsing daemon attempts to parse the malformed headers. Due to CWE-400, the parsing routine fails to handle the malformed input gracefully, leading to uncontrolled memory consumption or an infinite loop in the parsing logic. The iLO web service becomes unresponsive within minutes of sustained traffic.
4. Post-exploitation Impact: The iLO ceases to respond to any network requests (HTTPS, SSH, IPMI). The management processor may automatically reboot after a watchdog timeout, but repeated exploitation causes a recurring cycle. The host server continues running, but all out-of-band management is unavailable. If the data center is breached, the attacker has effectively neutralized the organization's primary remote management path, hindering the victim's ability to recover systems or respond to further attacks.

Scenario 2: IPMI RMCP+ State Exhaustion

1. Reconnaissance: The attacker scans for UDP port 623 (IPMI RMCP) on the management VLAN. The iLO responds with a valid RMCP+ open session response, confirming the service.
2. Weaponization: Using the ipmitool utility or a custom script, the attacker initiates dozens of concurrent RMCP+ session open requests. Each request allocates a state table entry in the iLO's session handler. The attacker deliberately leaves sessions in a half-open state (sending the first packet but never completing the session handshake).
3. Trigger: The session table fills up entirely as the half-open connections remain in memory until a timeout. Once the table is full, legitimate management sessions — including valid administrator logins via the web interface or SSH — are silently rejected because the session table cannot allocate new entries.
4. Post-exploitation Impact: The iLO remains powered on but is effectively a brick — no legitimate management sessions can be established. The attacker can repeat this attack at any time to maintain the DoS condition, without needing physical access or credentials.

Impact Assessment

The business impact of CVE-2026-63457 centers entirely on the availability of out-of-band management infrastructure. For enterprise environments, the iLO is a critical component of server lifecycle management — it is used for initial OS deployment (via virtual media), BIOS updates, hardware health monitoring, and emergency remote recovery when the host OS crashes. A successful DoS attack against the iLO translates directly to:

• Operational downtime: Administrators cannot remotely reboot a crashed host, mount recovery ISO images, or inspect hardware sensor data. The only recovery method is physical access to the server, which may be challenging in locked or remote data center facilities.
• Continuous availability impact: The CVSS availability subscore is 3.6/10 (High), reflecting the total loss of a single management component. The confidentiality and integrity subscores are 0.0/10, confirming that this vulnerability does not leak data or allow code execution.
• Attack surface: The AV:A component indicates that exploitation requires adjacent network access. In well-segmented environments where the management VLAN is strictly isolated from production traffic, the realistic risk is lower. However, in flat networks or environments where management and production VLANs share L2 adjacency, the exposure is substantially higher.
• Blast radius: All HPE Gen10 and Gen10 Plus servers using iLO 6 firmware below v1.78 are affected. This includes a significant portion of current enterprise HPE server fleets. Given that management processors are often shared across multiple physical servers within a rack, a single compromised management switch segment could enable attacks against multiple iLOs simultaneously.

Detection Guidance

Sigma Rule

title: HPE iLO 6 Denial of Service Traffic Pattern
id: 7f8e9a1b-3c2d-4e5f-8a9b-0c1d2e3f4a5b
status: experimental
description: Detects network traffic patterns consistent with attempted exploitation of CVE-2026-63457 against HPE iLO 6 management interfaces.
references:
    - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63457
author: Valtersit Threat Intelligence Team
date: 2026/01/15
logsource:
    category: network_connection
    product: firewall
    service: traffic
detection:
    selection_ports:
        destination.port:
            - 443
            - 4433
            - 623
    selection_http_malformed:
        http.request.uri|contains:
            - '%00'
            - '..%2f'
        http.request.body|length: '> 8192'
    selection_high_rate:
        # aggregated event counts per source IP within 60 seconds
        events_per_minute: '> 500'
    condition: selection_ports and (selection_http_malformed or selection_high_rate)
    timeframe: 60s
level: high
falsepositives:
    - Legitimate high-frequency IPMI polling by monitoring tools
    - Large-scale firmware update pushes
fields:
    - destination.ip
    - source.ip
    - destination.port
tags:
    - attack.t1499
    - cve.2026-63457

YARA Rule

rule CVE_2026_63457_HPE_iLO6_Malformed_HTTP
{
    meta:
        author = "Valtersit Threat Intelligence"
        date = "2026-01-15"
        description = "Detects malformed HTTP requests targeting HPE iLO 6 web interface"
        cve = "CVE-2026-63457"
        reference = "https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63457"
    strings:
        $m1 = "Integrated Lights-Out" ascii
        $m2 = "iLO6" ascii
        $p1 = "GET / HTTP/1.1\r\nHost: " ascii
        $p2 = "Content-Length: 99999999" ascii
        $p3 = "Transfer-Encoding: chunked\r\nX-Real-IP:" ascii
        $p4 = "%00%00%00%00" ascii
        $p5 = { 41 42 43 44 45 46 47 48 49 4A 4B 4C 4D 4E 4F 50 } // 'ABCDEFGHIJKLMNOP' repeated
    condition:
        uint16(0) == 0x4D42 or
        any of ($p*) and any of ($m*)
}

Suricata IDS Rule

alert tcp any any -> any 443 (msg:"CVE-2026-63457 HPE iLO6 DoS HTTP flood attempt"; flow:to_server,established; content:"GET"; http_method; content:"HTTP/1.1"; http_protocol; threshold:type both, track by_src, count 200, seconds 10; classtype:attempted-dos; reference:cve,2026-63457; sid:10000001; rev:1;)

alert udp any any -> any 623 (msg:"CVE-2026-63457 HPE iLO6 IPMI RMCP+ session exhaustion"; content:"|06 00 00 00|"; depth:4; threshold:type both, track by_src, count 300, seconds 60; classtype:attempted-dos; reference:cve,2026-63457; sid:10000002; rev:1;)

alert tcp any any -> any 4433 (msg:"CVE-2026-63457 HPE iLO6 HTTPS malformed header"; flow:to_server,established; content:"Host:"; http_header; content:"Content-Length"; http_header; content:"99999"; http_header; distance:0; classtype:attempted-dos; reference:cve,2026-63457; sid:10000003; rev:1;)

Elastic Detection

// Elastic EQL query to detect high-rate connections to iLO management ports
sequence by source.ip with maxspan=1m
  [any where destination.port in (443, 4433, 623)]
  [any where destination.port in (443, 4433, 623)]
  [any where destination.port in (443, 4433, 623)]
  [any where destination.port in (443, 4433, 623)]

// Alternative: count aggregation detection
network where destination.port in (443, 4433, 623) and
  network.direction == "egress" and
  // Group by source and count over 60s window
  // Use a custom watcher or anomaly detection job
  // This EQL matches sessions with abnormally long duration and high packet counts
  network.bytes > 1000000 and
  network.packets > 10000

Splunk SPL Query

index=netflow OR index=firewall
| where dest_port IN (443, 4433, 623)
| stats count as event_count, dc(dest) as dest_count, values(dest) as destinations by src_ip
| where event_count > 500 AND dest_count > 5
| eval risk_score = (event_count / dest_count)
| sort - risk_score
| table _time, src_ip, destinations, event_count, dest_count, risk_score
| rename src_ip as "Source IP", destinations as "Targeted iLO Hosts", event_count as "Event Volume"

index=webserver
| where uri_path IN ("/cgi/*", "/rest/*", "/redfish/*")
| search "*Integrated*Lights*Out*" OR "iLO6" OR "Server Response: HTTP/1.1 400"
| stats count as malformed_request_count by src_ip, uri_path
| where malformed_request_count > 100
| table _time, src_ip, uri_path, malformed_request_count

Wazuh OSSEC Rule

<group name="hpe_ilo6_dos,">
  <rule id="100321" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.dataset">suricata.eve</field>
    <field name="suricata.eve.signature_id">10000001</field>
    <description>HPE iLO6 DoS attempt detected - HTTP flood (CVE-2026-63457)</description>
    <group>attack.t1499,</group>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>

  <rule id="100322" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.dataset">suricata.eve</field>
    <field name="suricata.eve.signature_id">10000002</field>
    <description>HPE iLO6 DoS attempt detected - IPMI RMCP+ session exhaustion (CVE-2026-63457)</description>
    <group>attack.t1499,</group>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>

  <rule id="100323" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.dataset">firewall</field>
    <field name="dest_port">623</field>
    <field name="action">blocked</field>
    <description>HPE iLO6 management port 623 flood blocked - potential CVE-2026-63457 exploitation</description>
    <group>attack.t1499,</group>
    <mitre>
      <id>T1499</id>
    </mitre>
    <options>no_full_log</options>
    <frequency>5</frequency>
    <timeframe>60</timeframe>
    <same_source_ip/>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

The NVD description states the vulnerability exists "prior to v1.78," which confirms that HPE iLO 6 firmware version v1.78 contains the fix. However, as of the writing of this report, no official HPE security advisory, release notes, or publicly available firmware binary for v1.78 has been confirmed by any tracked source. Patch confidence remains at 0/4.

Immediate Mitigations (Until Patch is Available and Deployed):

1. Network Segmentation: Ensure the iLO management network is isolated on a dedicated VLAN with strict firewall rules. Block all inbound traffic to ports 443, 4433, 623, 17990, and 22 on iLO interfaces from any source except authorized management workstations and monitoring systems. This significantly reduces the AV:A attack surface.
2. Disable Unused Services: If the SSH interface is not required, disable it via the iLO web UI or ilorest CLI. Similarly, if the IPMI/Redfish interface is not used for monitoring, disable the IPMI over LAN service to eliminate the UDP/623 attack vector.
3. Access Control Lists (ACLs): Apply source IP ACLs directly on the iLO service, restricting management access to specific bastion hosts or admin jump servers. Block all addresses outside the management subnet.
4. Traffic Rate Limiting: Configure network switches or firewalls to rate-limit traffic to iLO management ports. Limit connections per source IP to prevent flood-based resource exhaustion.
5. Monitoring: Deploy the Sigma/Suricata rules from the Detection Guidance section to alert on anomalous traffic patterns toward iLO interfaces.

Patch/Upgrade Steps (Once v1.78 is Available):

1. Download the iLO 6 firmware v1.78 binary from the official HPE Support Portal (support.hpe.com).
2. Backup the current iLO configuration using the ilorest utility (ilorest save or via the web UI under "Maintenance → Save Configuration").
3. Upload the firmware image via the iLO web interface (Maintenance → Firmware Update) or using the HPE SUM (Smart Update Manager) tool for offline updates.
4. Follow the firmware flash process; the iLO will reboot automatically. Verify firmware revision post-update via the web UI (Home → Firmware Information) or ilorest --version.
5. After first boot with the new firmware, test all management interfaces (HTTPS, SSH, IPMI, Redfish) to confirm normal operation.

Long-Term Hardening:

1. Disable "Management Processor Remote Access" on shared NICs where dedicated management ports are available, reducing exposure to host network traffic.
2. Rotate iLO credentials using Best Practices from NIST SP 800-190 — do not use default passwords; integrate with a privileged access management (PAM) solution.
3. Deploy centralized monitoring with SNMP traps from iLO to a SIEM, ensuring that a DoS event generates immediate alerts for physical intervention.
4. Establish physical security controls for data center racks — since the attack vector includes adjacent network access, an attacker with physical access to a management switch port is a primary threat actor. Use port security and MAC address binding on management switches.
5. Follow HPE security bulletins and subscribe to the HPE Support Alerts mailing list to receive notification when the v1.78 firmware becomes generally available.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-63457 — Official NVD record with CVSS v3.1 vector and description.
2. CVE.org Record: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-63457 — MITRE CVE entry (vendor-neutral).
3. HPE Support Portal: https://support.hpe.com/ — Vendor advisory and firmware download portal. Reference "HPE iLO 6 Documentation" for firmware v1.78 release notes (expected publication).
4. HPE ILO 6 Security Bulletin: https://support.hpe.com/hpesc/public/docDisplay?docId=hpesbgn04701en_us — HPE Security Bulletin for iLO 6 vulnerabilities (reference the advisory accompanying this CVE once published).
5. FIRST EPSS: https://www.first.org/epss/ — EPSS API referenced; this CVE is not yet scored by FIRST.org as of the report date.

Threat Actor / Exploit-in-the-Wild Status: No known threat actor campaigns or exploit-in-the-wild evidence exists for CVE-2026-63457 at the time of this report. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. CISA KEV status: NO.