31 matches found
CosmicRakp
CosmicRakp Table of Contents Introduction CVE-2013-4786 Installation Usage Credits License Introduction CosmicRakp is a powerful tool written in Go that allows red teamers and penetration testers to dump IPMI hashes. This project aims to be efficient, fast, and easy to use. CVE-2013-4786 This too...
CVE-2026-16141
OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed...
CVE-2026-16141 OpenBMC IPMI Authentication Bypass via Default userKey and Stale Challenge Value
OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed...
CVE-2026-16141 OpenBMC IPMI Authentication Bypass via Default userKey and Stale Challenge Value
OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed...
EUVD-2026-78573
OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed...
CVE-2026-16141
OpenBMC's IPMI implementation, phosphor-net-ipmid , contains a logic flaw allowing an unauthenticated client to bypass RAKP authentication. An attacker can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults, causing the service to acce...
CVE-2026-16140 OpenBMC IPMI Privilege Escalation via Retargeted RAKP 1
OpenBMC's IPMI implementation, phosphor-net-ipmid, is vulnerable to a logic flaw where the authorization context of an existing session can be replaced with a target account while still maintaining the original integrity and encryption keys. Several downstream vendors implement phosphor-net-ipmid...
CVE-2026-16140 OpenBMC IPMI Privilege Escalation via Retargeted RAKP 1
OpenBMC's IPMI implementation, phosphor-net-ipmid, is vulnerable to a logic flaw where the authorization context of an existing session can be replaced with a target account while still maintaining the original integrity and encryption keys. Several downstream vendors implement phosphor-net-ipmid...
PT-2026-92020
OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed...
EUVD-2013-3968
Malware in sbrugna...
IPMI 2.0 RAKP Remote SHA1 Password Hash Retrieval
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'IPMI 2.0 RAKP Remote SHA1 Password Hash Retrieval', 'Description' = %q| This module identifies IPMI 2.0-compatible systems and attempts to retrie...
BMC software fails to validate IPMI session.
Overview The Intelligent Platform Management Interface IPMI implementations in multiple manufacturer's Baseboard Management Controller BMC software are vulnerable to IPMI session hijacking. An attacker with access to the BMC network with IPMI enabled can abuse the lack of session integrity to...
Security Bulletin: Risks of Using the Intelligent Platform Management Interface (IPMI) on the Integrated Management Module (IMM) and Integrated Management Module II (IMM2) (CVE-2013-4038, CVE-2013-4037, CVE-2013-4031)
Summary Various risks with the Intelligent Platform Management Interface IPMI have been identified and documented in the IT security community. Because the IMM and IMM2 provide IPMI access by default, a subset of these identified risks are applicable to IBM servers that include the IMM and IMM2...
K16846: IPMI vulnerability CVE-2013-4786
Security Advisory Description The IPMI 2.0 specification supports RMCP+ Authenticated Key-Exchange Protocol RAKP authentication, which allows remote attackers to obtain password hashes and conduct offline password guessing attacks by obtaining the HMAC from a RAKP message 2 response from a BMC...
Inherent Risks of Using the Intelligent Platform Management Interface (IPMI) on the Lenovo System x Integrated Management Module (IMM), Integrated Management Module II (IMM2) and ThinkServer TSM - Lenovo Support US
No description provided...
Inherent Risks of Using the Intelligent Platform Management Interface (IPMI) on the Lenovo System x Integrated Management Module (IMM), Integrated Management Module II (IMM2) and ThinkServer TSM - us
Lenovo Security Advisory: LEN-10617 Potential Impact: Access to systems through IPMI if default settings are not changed Severity: High Scope of Impact: Industry-Wide CVE Identifiers: CVE-2013-4037, CVE-2013-4031 Summary Description: Various risks with the industry-standard Intelligent Platform...
IPMI v2.0 Password Hash Disclosure
The remote host supports IPMI v2.0. The Intelligent Platform Management Interface IPMI protocol is affected by an information disclosure vulnerability due to the support of RMCP+ Authenticated Key-Exchange Protocol RAKP authentication. A remote attacker can obtain password hash information for...
CVE-2013-4037
The RAKP protocol support in the Intelligent Platform Management Interface IPMI implementation in Integrated Management Module IMM and Integrated Management Module II IMM2 on IBM BladeCenter, Flex System, System x iDataPlex, and System x3 servers sends a password hash to the client, which makes i...
Design/Logic Flaw
The RAKP protocol support in the Intelligent Platform Management Interface IPMI implementation in Integrated Management Module IMM and Integrated Management Module II IMM2 on IBM BladeCenter, Flex System, System x iDataPlex, and System x3 servers sends a password hash to the client, which makes i...
CVE-2013-4037
The RAKP protocol support in the Intelligent Platform Management Interface IPMI implementation in Integrated Management Module IMM and Integrated Management Module II IMM2 on IBM BladeCenter, Flex System, System x iDataPlex, and System x3 servers sends a password hash to the client, which makes i...