EUVD-2026-78573
GHSA-28w7-pg33-g2hj
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (runZero) · only source for this CVE.
CVSS VectorVendor: runZero
Lifecycle Timeline
2DescriptionCVE.org
OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed with the constant 20-byte 'userKey' initialized from the string '0penBmc' and an often-predictable 'bmcRandomNum'. Several downstream vendors implement phosphor-net-ipmid as their IPMI stack, such as NVIDIA and H3C.
AnalysisAI
An authentication bypass in OpenBMC's phosphor-net-ipmid IPMI stack lets a network attacker with no credentials complete IPMI 2.0 RAKP session authentication and obtain full BMC control. A crafted RAKP Message 1 forces the handler to return before the authentication object's constructor defaults are overwritten, so the service accepts a RAKP Message 3 whose HMAC is keyed with the hard-coded 20-byte 'userKey' derived from the string '0penBmc' combined with an often-predictable 'bmcRandomNum'. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
In OpenBMC 2.9, crafted IPMI messages allow an attacker to bypass authentication and gain full control of the system. Ra
Privilege escalation in OpenBMC's phosphor-net-ipmid IPMI stack allows an attacker who already holds a valid low-privile
user_channel/passwd_mgr.cpp in OpenBMC phosphor-host-ipmid before 2020-04-03 does not ensure that /etc/ipmi-pass has str
A vulnerability in the combination of the OpenBMC's FW1050.00 through FW1050.10, FW1030.00 through FW1030.50, and FW1020
IBM OpenBMC FW1050.00 through FW1050.10 BMCWeb HTTPS server component could disclose sensitive URI content to an unautho
A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. Rated high severity (CVSS 7.5), thi
A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. Rated high severity (CVSS 7.5), thi
Arbitrary code execution in IBM OpenBMC FW1060.00 through FW1060.80 is achievable via a path traversal flaw (CWE-22) in
Same weakness CWE-798 – Use of Hard-coded Credentials
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today