EUVD-2026-85893
GHSA-34jw-2gcw-f6v2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain high-privileged access on managed host
-
ExploitSend crafted request to BMC firmware management interface
-
ExecutionTrigger out-of-bounds read in firmware management service
-
ImpactCrash service or leak limited BMC internal memory
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, read limits
MITRE ATT&CK
1 technique across 1 tactic: Collection The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker already hold high-privileged control of the managed host system, because the flaw lives in the host-facing BMC firmware management interface (AV:L, PR:H) - it is not reachable over the network by an unauthenticated attacker. The affected component is the BMC firmware management service on IBM OpenBMC at specific firmware levels (FW1120.00-1120.01, FW1110.00-1110.31, FW1060.00-1060.81); systems outside these ranges are not affected. No user interaction is needed once host privilege is obtained. The primary limiting factor - needing to already own the host at high privilege - sharply narrows realistic attackers to those who have already compromised the managed system. |
| Impact | This is a genuinely low-priority issue, and the signals are internally consistent. The CVSS 3.1 base score is 3.4 with vector AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L - local attack vector, high privileges required, and only limited (Low) confidentiality and availability impact. There is no EPSS score, no CISA KEV listing, and no public exploit code identified at time of analysis, so exploitation status is 'no public exploit identified at time of analysis.' The key limiting factor is that the attacker must already have high-privileged control of the managed host system to reach the BMC firmware management interface - this is a host-to-BMC boundary crossing, not a remote-network exposure. No conflicting signals were found: the local/high-privilege vector aligns with the description ('the host system can cause...'). The main missing data is any patched firmware level (IBM lists affected FW ranges but the advisory node was not parsed for fixed builds) and EPSS/POC status. Bottom line: real-world urgency is minimal; prioritize only in high-assurance environments where host-to-BMC isolation is part of the trust model. |
| Exploit ScenarioDerived | An attacker who has already gained high-privileged code execution on the managed host operating system sends crafted requests across the host-to-BMC firmware management interface. This either crashes the BMC firmware management service (availability loss to the management plane) or coaxes it into returning a small amount of BMC internal memory (limited confidentiality leak). No public exploit code has been identified, and exploitation requires pre-existing high privilege on the host (AV:L/PR:H). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
A limited out-of-bounds memory read in the host-facing BMC firmware management service of IBM OpenBMC can be triggered by a host system to crash that service and read a small amount of BMC internal memory, producing low confidentiality and availability impact (CVSS 3.4). Only agents who already hold high-privileged control of the managed host can reach the vulnerable interface, since the flaw sits on the local host-to-BMC path (AV:L, PR:H) rather than on the network. Affected firmware levels are FW1060.00 through FW1060.81, FW1110.00 through FW1110.31, and FW1120.00 through FW1120.01; there is no public exploit code identified and no confirmed active exploitation (not in CISA KEV), so the practical risk is low and is largely contingent on the host already being compromised at a privileged level.
RemediationAI
No vendor-released patch identified at time of analysis; the IBM advisory at https://www.ibm.com/support/pages/node/7289253 is the authoritative source for a fixed firmware level and should be monitored for an update covering FW1060, FW1110, and FW1120 branches. Because exploitation requires an attacker to already hold high privileges on the managed host, the highest-value compensating control is host-side hardening: enforce least privilege and strict privileged-access management (remove unnecessary root/sudo rights, require MFA and session auditing for administrative logins) so that no non-trusted process can issue firmware-management requests to the BMC. Network-isolating the BMC management plane from general-purpose and hostile networks reduces the reachable attack surface but does not mitigate this specific host-path flaw, and it carries the trade-off of complicating out-of-band monitoring and remote recovery. Enabling BMC log forwarding and alerting on firmware-management service crashes or unexpected restarts gives a detection signal for abuse attempts, at the cost of additional log volume and tuning. Blocking or disabling unused host-to-BMC firmware management functions where platform tooling permits it is effective but may break firmware update workflows and vendor support tooling, so it should be validated in a lab first. Restrict physical and out-of-band access to the BMC as well, since an attacker who controls the host at high privilege may chain this read primitive with other BMC weaknesses.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability is a CWE-125 out-of-bounds read in the BMC firmware management service of IBM OpenBMC, the Linux-based baseboard management controller firmware stack that exposes flashing, inventory, and firmware-management operations to the managed host. Because the affected service is one of the host-facing interfaces (the host processor communicates with the BMC over the internal board interface rather than over an external network socket), the exploitation path begins on the managed host itself. A malformed request crafted by a host-side component causes the service to read past the bounds of an internal buffer, which both discloses a limited slice of BMC memory and terminates or destabilizes the service. The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L confirms local attack vector, high privileges required, no user interaction, unchanged scope, and low confidentiality and availability impact; the CPE data set provided does not enumerate distinct product identifiers, so scope is defined by the IBM firmware levels in the advisory.
Know when Openbmc gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:L
Local host-to-BMC interface (AV:L) reachable only with high host privilege (PR:H); limited memory read (C:L) and service crash (A:L), no integrity impact and no scope change.
Primary rating from Vendor (us).
CVSS VectorVendor: us
DescriptionCVE.org
IBM OPENBMC FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the BMC firmware management interface. The host system can cause the BMC firmware management service to crash or allow a limited amount of BMC internal memory to be read, resulting in a confidentiality and availability impact to the managed system.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
In OpenBMC 2.9, crafted IPMI messages allow an attacker to bypass authentication and gain full control of the system. Ra
Privilege escalation in OpenBMC's phosphor-net-ipmid IPMI stack allows an attacker who already holds a valid low-privile
user_channel/passwd_mgr.cpp in OpenBMC phosphor-host-ipmid before 2020-04-03 does not ensure that /etc/ipmi-pass has str
An authentication bypass in OpenBMC's phosphor-net-ipmid IPMI stack lets a network attacker with no credentials complete
A vulnerability in the combination of the OpenBMC's FW1050.00 through FW1050.10, FW1030.00 through FW1030.50, and FW1020
IBM OpenBMC FW1050.00 through FW1050.10 BMCWeb HTTPS server component could disclose sensitive URI content to an unautho
A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. Rated high severity (CVSS 7.5), thi
A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. Rated high severity (CVSS 7.5), thi
Arbitrary code execution in IBM OpenBMC FW1060.00 through FW1060.80 is achievable via a path traversal flaw (CWE-22) in
Incorrect privilege assignment in Huawei openUBMC causes the SNMP pseudo-identity group (special_users, including the SN
Out-of-bounds memory reads in the openUBMC device-management process can be induced by a malicious or compromised device
Exploit-DB