PT-2024-26327 · Openbmc · Openbmc

Published 2024-08-13 · Updated 2024-08-22 · CVE-2024-35124

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenBMC versions FW1020.00 through FW1020.60 OpenBMC versions FW1030.00 through FW1030.50 OpenBMC versions FW1050.00 through FW1050.10

Description A vulnerability in the combination of OpenBMC's default password and session management allows an attacker to gain administrative access to the BMC. This issue affects multiple firmware versions of OpenBMC.

Recommendations For OpenBMC versions FW1020.00 through FW1020.60, update to a version that fixes the default password and session management issue. For OpenBMC versions FW1030.00 through FW1030.50, update to a version that fixes the default password and session management issue. For OpenBMC versions FW1050.00 through FW1050.10, update to a version that fixes the default password and session management issue. As a temporary workaround, consider restricting access to the BMC to minimize the risk of exploitation.

Fix

Missing Authentication

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-306

CWE-288

Related Identifiers

CVE-2024-35124

Affected Products

Openbmc

References · 10

• https://osv.dev/vulnerability/CVE-2024-35124 · Vendor Advisory
• https://ibm.com/support/pages/node/7163195 · Vendor Advisory
• https://https//exchange.xforce.ibmcloud.com/vulnerabilities/290674 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-35124 · Security Note
• https://twitter.com/CVEnew/status/1823320064877326612 · Twitter Post
• https://t.me/cvedetector/3011 · Telegram Post
• https://t.me/cvenotify/90249 · Telegram Post
• https://twitter.com/cracbot/status/1825050078060707975 · Twitter Post
• https://twitter.com/oktsec/status/1824887467591274514 · Twitter Post
• https://twitter.com/PorsilapongoCl/status/1823321116863012948 · Twitter Post