What is the CVSS score of CVE-2014-0860?

CVE-2014-0860 has a CVSS 2.0 base score of 5.0 (Medium). CVSS vector: AV:N/AC:L/Au:N/C:P/I:N/A:N. EPSS exploitation probability: 0.2%.

Integrated Management Module Firmware CVE-2014-0860

MEDIUM

Cryptographic Issues (CWE-310)

2014-07-07 psirt@us.ibm.com

IBM Information Disclosure Integrated Management Module Firmware Integrated Management Module Advanced Management Module Firmware Advanced Management Module Integrated Management Module Ii Firmware Integrated Management Module Ii

5.0

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

5.0 MEDIUM

AV:N/AC:L/Au:N/C:P/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

AV:N/AC:L/Au:N/C:P/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Confidentiality

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Jul 07, 2014 - 11:01 cve.org

MEDIUM 5.0

DescriptionCVE.org

The firmware before 3.66E in IBM BladeCenter Advanced Management Module (AMM), the firmware before 1.43 in IBM Integrated Management Module (IMM), and the firmware before 4.15 in IBM Integrated Management Module II (IMM2) contains cleartext IPMI credentials, which allows attackers to execute arbitrary IPMI commands, and consequently establish a blade remote-control session, by leveraging access to (1) the chassis internal network or (2) the Ethernet-over-USB interface.

AnalysisAI

The firmware before 3.66E in IBM BladeCenter Advanced Management Module (AMM), the firmware before 1.43 in IBM Integrated Management Module (IMM), and the firmware before 4.15 in IBM Integrated. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-310. The firmware before 3.66E in IBM BladeCenter Advanced Management Module (AMM), the firmware before 1.43 in IBM Integrated Management Module (IMM), and the firmware before 4.15 in IBM Integrated Management Module II (IMM2) contains cleartext IPMI credentials, which allows attackers to execute arbitrary IPMI commands, and consequently establish a blade remote-control session, by leveraging access to (1) the chassis internal network or (2) the Ethernet-over-USB interface. Affected products include: Ibm Integrated Management Module Firmware, Ibm Integrated Management Module, Ibm Advanced Management Module Firmware, Ibm Advanced Management Module, Ibm Integrated Management Module Ii Firmware. Version information: before 3.66.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.