Lucene search

IbmCVE-2024-35124

HistoryAug 13, 2024 - 12:15 p.m.

CVE-2024-35124

2024-08-1312:15:06

CWE-306

CWE-288

ibm

web.nvd.nist.gov

openbmc

firmware

unauthorized access

ibm x-force

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

32.5%

JSON

A vulnerability in the combination of the OpenBMC’s FW1050.00 through FW1050.10, FW1030.00 through FW1030.50, and FW1020.00 through FW1020.60 default password and session management allow an attacker to gain administrative access to the BMC. IBM X-Force ID: 290674.

Affected configurations

Nvd

Vulners

Node

ibmopenbmcRangefw1020.00–fw1020.60

ibmopenbmcRangefw1030.00–fw1030.50

ibmopenbmcRangefw1050.00–fw1050.10

VendorProductVersionCPE
ibmopenbmc*cpe:2.3:o:ibm:openbmc:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	openbmc	*	cpe:2.3:o:ibm:openbmc::::::::

CNA Affected

[
  {
    "cpes": [
      "cpe:2.3:o:ibm:openbmc:FW1020.00:*:*:*:*:*:*:*",
      "cpe:2.3:o:ibm:openbmc:FW1020.60:*:*:*:*:*:*:*",
      "cpe:2.3:o:ibm:openbmc:FW1030.00:*:*:*:*:*:*:*",
      "cpe:2.3:o:ibm:openbmc:FW1030.50:*:*:*:*:*:*:*",
      "cpe:2.3:o:ibm:openbmc:FW1050.00:*:*:*:*:*:*:*",
      "cpe:2.3:o:ibm:openbmc:FW1050.10:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "product": "OpenBMC",
    "vendor": "IBM",
    "versions": [
      {
        "lessThanOrEqual": "FW1050.10",
        "status": "affected",
        "version": "FW1050.00",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "FW1030.50",
        "status": "affected",
        "version": "FW1030.00",
        "versionType": "semver"
      },
      {
        "lessThanOrEqual": "FW1020.60",
        "status": "affected",
        "version": "FW1020.00",
        "versionType": "semver"
      }
    ]
  }
]

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/290674

www.ibm.com/support/pages/node/7163195

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

32.5%

JSON

Related for CVE-2024-35124