Back

CVE-2024-35124

Aug. 13, 2024, 12:58 p.m.

Undergoing Analysis
CVE has been marked for Analysis. Normally once in this state the CVE will be analyzed by NVD staff within 24 hours.

Products

OpenBMC

  • FW1050.00 - FW1050.10
  • FW1030.00 - FW1030.50
  • FW1020.00 - FW1020.60

Source

psirt@us.ibm.com

Tags

psirt@us.ibm.com
CWE-288
2024-08-13
CVE-2024-35124

CVE-2024-35124 details

Published : Aug. 13, 2024, 12:15 p.m.
Last Modified : Aug. 13, 2024, 12:58 p.m.

Description

A vulnerability in the combination of the OpenBMC's FW1050.00 through FW1050.10, FW1030.00 through FW1030.50, and FW1020.00 through FW1020.60 default password and session management allow an attacker to gain administrative access to the BMC. IBM X-Force ID: 290674.

CVSS Score

1 2 3 4 5 6 7.5 8 9 10

Weakness

Weakness Name Description
CWE-288 Authentication Bypass Using an Alternate Path or Channel A product requires authentication, but the product has an alternate path or channel that does not require authentication.

CVSS Data

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

7.5

Exploitability Score

1.6

Impact Score

5.9

Base Severity

HIGH

Vector String : CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

References

URL Source
https://https://exchange.xforce.ibmcloud.com/vulnerabilities/290674 psirt@us.ibm.com
https://www.ibm.com/support/pages/node/7163195 psirt@us.ibm.com
This website uses the NVD API, but is not approved or certified by it.