PT-2019-16946 · Ibm · Ibm Open Power Firmware

Published 2019-08-26 · Updated 2022-12-09 · CVE-2019-4169

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions IBM Open Power Firmware versions OP910 and OP920

Description The issue allows access to the Baseboard Management Controller (BMC) via Intelligent Platform Management Interface (IPMI) using the default OpenBMC password, even after the BMC password has been changed from the default.

Recommendations For IBM Open Power Firmware versions OP910 and OP920, change the default OpenBMC password to a unique and secure password to prevent unauthorized access to the BMC via IPMI.

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2019-4169

Affected Products

Ibm Open Power Firmware

References · 4

• https://exchange.xforce.ibmcloud.com/vulnerabilities/158702 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=ibm10881209 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-4169 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-4169 · Security Note