EUVD-2026-49885
GHSA-mm39-vmv6-rcvf
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (us).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionNVD
IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows a user to supply a password with a resource dump request stores that password into the BMC audit log where an admin user can see it.
AnalysisAI
Credential exposure in IBM OPENBMC firmware allows administrative users to view passwords logged from resource dump requests. Affected firmware versions FW1110.00 through FW1110.20 and FW1060.00 through FW1060.71 store passwords supplied during resource dump operations in the BMC audit log, where they are accessible to users with administrative privileges. No active exploitation or public exploits have been identified.
Privilege escalation in IBM OpenBMC firmware allows any authenticated ReadOnly user to grant themselves full administrat
IBM PowerVM Hypervisor across four active firmware release trains is vulnerable to arbitrary Hostboot memory read and wr
Arbitrary code execution on IBM Power host systems is possible when an attacker with service processor access supplies a
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today