EUVD-2026-62849
GHSA-5j8f-fc55-9mwx
Severity by source
AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Adjacent access and administrator credentials required (AV:A/PR:H) to reach the firmware update interface; path traversal exploitation is straightforward once prerequisites are met (AC:L).
Primary rating from Vendor (ibm).
CVSS VectorVendor: ibm
Lifecycle Timeline
1DescriptionCVE.org
IBM OpenBMC FW1060.00 through FW1060.80 is affected by a vulnerability in the BMC firmware update process. An attacker with authenticated administrator-level access to the BMC can, under specific conditions, execute arbitrary code, resulting in a confidentiality, integrity, and availability impact.
AnalysisAI
Arbitrary code execution in IBM OpenBMC FW1060.00 through FW1060.80 is achievable via a path traversal flaw (CWE-22) in the BMC firmware update process, resulting in full confidentiality, integrity, and availability compromise of the baseboard management controller. Exploitation is constrained to authenticated administrators with adjacent network access to the BMC management interface, substantially limiting the real-world attack surface despite the high CIA impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following to be simultaneously true: (1) the attacker must hold authenticated administrator-level credentials for the IBM OpenBMC interface - CVSS PR:H confirms that high-privilege authentication is a hard prerequisite, not merely a risk-reducing factor; (2) the BMC firmware version must fall within FW1060.00 through FW1060.80; (3) the attacker must be positioned on the adjacent network segment hosting the BMC management interface (CVSS AV:A), typically an isolated IPMI or out-of-band management VLAN not reachable from the internet; (4) the firmware update feature must be accessible through the BMC interface, which is standard functionality and not a non-default configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.8 (Medium) accurately reflects a constrained but high-impact risk profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch referenced in the IBM security advisory at https://www.ibm.com/support/pages/node/7283590 - the exact patched firmware version was not specified in the available input data and must be confirmed directly from that advisory page before deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
In OpenBMC 2.9, crafted IPMI messages allow an attacker to bypass authentication and gain full control of the system. Ra
Privilege escalation in OpenBMC's phosphor-net-ipmid IPMI stack allows an attacker who already holds a valid low-privile
user_channel/passwd_mgr.cpp in OpenBMC phosphor-host-ipmid before 2020-04-03 does not ensure that /etc/ipmi-pass has str
An authentication bypass in OpenBMC's phosphor-net-ipmid IPMI stack lets a network attacker with no credentials complete
A vulnerability in the combination of the OpenBMC's FW1050.00 through FW1050.10, FW1030.00 through FW1030.50, and FW1020
IBM OpenBMC FW1050.00 through FW1050.10 BMCWeb HTTPS server component could disclose sensitive URI content to an unautho
A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. Rated high severity (CVSS 7.5), thi
A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. Rated high severity (CVSS 7.5), thi
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today