ipmi

I wrote some software to explore IPMI; here are some of results. I thought I'd do the usual detect, get data, and audit sort of cycle. Each of these turned out to be fairly interesting problem on its own, at least to me. BTW/FYI - I released a new tool to explore IPMI -...

bmc-tools

BMC-Tools RDP Bitmap Cache parser. Input bmc-tools processes bcache.bmc and cache????.bin files found inside Windows user profiles. Usage ./bmc-tools.py -h -s SRC -d DEST -c COUNT -v -o -b -w WIDTH With the following arguments meaning: -h, --help show this help message and exit -s SRC, --src SRC...

bmc_bladelogic

BMC Bladelogic RSCD remote exploits for Linux and Windows Change passwords, List users and Remote code execution Exploiting vulnerabilities in BMC BladeLogic RSCD agent CVE-2016-1542 BMC-2015-0010 CVE-2016-1543 BMC-2015-0011 CVE-2016-5063 Published on exploit-db BMCrexec.py...

CVE-2024-54085

CVE-2024-54085: Critical Authentication Bypass Vulnerability in AMI MegaRAC BMC Affected Systems The vulnerability affects a wide range of server hardware from major manufacturers: AMI MegaRAC SPx : versions 12.x up to 12.7 and 13.x up to 13.5 HPE Cray XD670 : versions 1.09, 1.13, 1.17 Asus...

CVE-2026-90458

OpenStack Ironic before 39.0.1 allows DELETE and GET via vendorpassthru, e.g., to delete accounts from the BMC's Redfish service...

CVE-2026-90458

OpenStack Ironic before 39.0.1 allows DELETE and GET via vendorpassthru, e.g., to delete accounts from the BMC's Redfish service...

PoC

PoC Repo for proof of concept exploits and tools. BMCRSCDRCE Unauthenticated remote command execution exploit for BMC Server Automation's RSCD agent. The exploit works against servers affected by CVE-2016-1542 detected by Nessus. This is now a Metasploit module, see...

SuperMicro-Password-Scanner

Supermicro IPMI/BMC Cleartext Password Scanner v20140622 by 1N3 https://crowdshield.com Usage: sh supermicroscan.sh proxy ABOUT: Supermicro’s implementation of IPMI/BMC allows remote, unauthenticated attackers to request the file PSBlock via port 49152. This plain text password file contains IPMI...

BMC FootPrints - Authentication Bypass

BMC FootPrints versions 20.20.02 through 20.24.01.001 contain an authentication bypass vulnerability in the password reset functionality. Unauthenticated attackers can access the /footprints/servicedesk/passwordreset/request/ endpoint to obtain a valid SECTOKEN session cookie without proper...

BMC FootPrints 'feedUrl' - Server-Side Request Forgery

BMC FootPrints versions 20.20.02 through 20.24.01.001 contain a Server-Side Request Forgery SSRF vulnerability in the /footprints/servicedesk/externalfeed/RSS endpoint. The 'feedUrl' parameter allows unauthenticated attackers to force the server to make HTTP requests to arbitrary URLs, enabling...

BMC FootPrints 'searchWeb' - Server-Side Request Forgery

BMC FootPrints versions 20.20.02 through 20.24.01.001 contain a Server-Side Request Forgery SSRF vulnerability in the /footprints/servicedesk/import/searchWeb endpoint. The 'url' parameter allows unauthenticated attackers to force the server to make HTTP requests to arbitrary URLs, enabling acces...

bladelogic_bmc-cve-2016-1542

bladelogicbmc-cve-2016-1542 A rebuilt version of the exploit for CVE-2016-1542 and CVE-2016-1543 from insinuator.net https://insinuator.net/2016/03/bmc-bladelogic-cve-2016-1542-and-cve-2016-1543/ I recently came across systems vulnerable to this CVE in a recent penetration test and found exploits...

PT-2026-121748

OpenStack Ironic before 39.0.1 allows DELETE and GET via vendor passthru, e.g., to delete accounts from the BMC's Redfish service...

CVE-2026-90458

A path traversal vulnerability was found in OpenStack Ironic Redfish vendor passthrough subscription management. An authenticated attacker with vendor passthrough privileges could use a crafted subscription id to access or delete arbitrary Redfish resources on a node's BMC. Mitigation There is no...

watchTowr-vs-BMC-Footprints-RCE-CVE-2025-71257-CVE-2025-71260

CVE-2025-71257 and CVE-2025-71260 BMC FootPrints Pre-Authenticated Remote Code Execution Chain BMC FootPrints Pre-Authenticated Remote Code Execution Chain Detection Artifact Generator Tool Description This Detection Artifact Generator verifies if BMC FootPrints instance is vulnerable to...

cve-2019-6260

A Test and Debug Tool for ASPEED BMC AHB Interfaces Warning DO NOT USE THIS TOOL IF YOU HAVE NOT UNDERSTOOD ITS BEHAVIOURS IN THE CONTEXT OF YOUR TARGET MACHINE. This tool pokes at low-level hardware and firmware interfaces of your machine. Particularly, the act of probing implies uncertainty abo...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-46177)

In the Linux kernel, the following vulnerability has been resolved: ipmi: Add limits to event and receive message requests The driver would just fetch events and receive messages until the BMC said it was done. To avoid issues with BMCs that never say they are done, add a limit of 10 fetches at a...

BMC Helix Network Management Authentication Bypass

BMC Helix Network Management versions before 26.3.01 contain an authentication bypass when SAML-based single sign-on is configured, allowing the local administrator account to authenticate with any password...

EUVD-2026-102474

BMC Helix Network Management on-prem before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username with an arbitrar...

CVE-2026-111283

BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username with an...