CVE-2024-3411 Insufficient Randomness When Validating an IPMI Authenticated Session

2024-04-3018:39:36

certcc

www.cve.org

ipmi

authenticated session

randomness

session hijacking

security controls

spoofed packets

bmc device

9.4 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

15.7%

JSON

Implementations of IPMI Authenticated sessions does not provide enough randomness to protect from session hijacking, allowing an attacker to use either predictable IPMI Session ID or weak BMC Random Number to bypass security controls using spoofed IPMI packets to manage BMC device.

CNA Affected

[
  {
    "vendor": "IPMI",
    "product": "IPMI",
    "versions": [
      {
        "status": "affected",
        "version": "2.0, revision 1.1E7"
      }
    ]
  }
]