Security Bulletin: IBM DataPower Gateway enables default IPMI account

Summary If IPMI over LAN Is enabled, a default administrator account is also enabled. Vulnerability Details CVEID: CVE-2019-4621 DESCRIPTION: IBM DataPower Appliance and IBM MQ Appliance have a default administrator account that is enabled if the IPMI LAN channel is enabled. A remote attacker cou...

IBM DataPower Gateway Security Bypass

According to its self-reported version, the IBM DataPower Gateway running on the remote host is affected by a security bypass vulnerability due to a default account that is present if the IPMI LAN channel is enabled. A remote attacker could use this account to gain unauthorised access to the BMC....

CVE-2019-4621: Initialization of a Resource with an Insecure Default

IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account that is enabled if the IPMI LAN channel is enabled. A remote attacker could use this account to gain unauthorised access to the BMC. IBM X-Force ID: 168883...

PT-2019-17143

Name of the Vulnerable Software and Affected Versions IBM DataPower Gateway versions 6.0.0 through 6.0.14 IBM DataPower Gateway versions 7.6.0.0 through 7.6.0 no end version specified, assuming up to but not including the next major release IBM DataPower Gateway versions 2018.4.1.0 through...