18 matches found
CVE-2026-16140
OpenBMC's IPMI implementation, phosphor-net-ipmid, is vulnerable to a logic flaw where the authorization context of an existing session can be replaced with a target account while still maintaining the original integrity and encryption keys. Several downstream vendors implement phosphor-net-ipmid...
CVE-2026-16141
OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed...
EUVD-2026-78573
OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed...
CVE-2026-16141 OpenBMC IPMI Authentication Bypass via Default userKey and Stale Challenge Value
OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed...
CVE-2026-16141
OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed...
CVE-2026-16141 OpenBMC IPMI Authentication Bypass via Default userKey and Stale Challenge Value
OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed...
CVE-2026-16141 OpenBMC IPMI Authentication Bypass via Default userKey and Stale Challenge Value
OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed...
CVE-2026-16141
OpenBMC's IPMI implementation, phosphor-net-ipmid , contains a logic flaw allowing an unauthenticated client to bypass RAKP authentication. An attacker can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults, causing the service to acce...
EUVD-2026-78572
OpenBMC's IPMI implementation, phosphor-net-ipmid, is vulnerable to a logic flaw where the authorization context of an existing session can be replaced with a target account while still maintaining the original integrity and encryption keys. Several downstream vendors implement phosphor-net-ipmid...
CVE-2026-16140 OpenBMC IPMI Privilege Escalation via Retargeted RAKP 1
OpenBMC's IPMI implementation, phosphor-net-ipmid, is vulnerable to a logic flaw where the authorization context of an existing session can be replaced with a target account while still maintaining the original integrity and encryption keys. Several downstream vendors implement phosphor-net-ipmid...
CVE-2026-16140
OpenBMC's IPMI implementation, phosphor-net-ipmid, is vulnerable to a logic flaw where the authorization context of an existing session can be replaced with a target account while still maintaining the original integrity and encryption keys. Several downstream vendors implement phosphor-net-ipmid...
CVE-2026-16140 OpenBMC IPMI Privilege Escalation via Retargeted RAKP 1
OpenBMC's IPMI implementation, phosphor-net-ipmid, is vulnerable to a logic flaw where the authorization context of an existing session can be replaced with a target account while still maintaining the original integrity and encryption keys. Several downstream vendors implement phosphor-net-ipmid...
CVE-2026-16140 OpenBMC IPMI Privilege Escalation via Retargeted RAKP 1
OpenBMC's IPMI implementation, phosphor-net-ipmid, is vulnerable to a logic flaw where the authorization context of an existing session can be replaced with a target account while still maintaining the original integrity and encryption keys. Several downstream vendors implement phosphor-net-ipmid...
CVE-2026-16140
CVE-2026-16140 affects OpenBMC's phosphor-net-ipmid , the IPMI implementation used by downstream vendors including NVIDIA and H3C . The root cause is a logic flaw in the RAKP authentication protocol that allows an attacker to replace the authorization context of an existing session with a target ...
PT-2026-92020
OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed...
CVE-2026-16141: Use of Hard-coded Credentials
OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed...
CVE-2026-16140: Incorrect Authorization
OpenBMC's IPMI implementation, phosphor-net-ipmid, is vulnerable to a logic flaw where the authorization context of an existing session can be replaced with a target account while still maintaining the original integrity and encryption keys. Several downstream vendors implement phosphor-net-ipmid...
PT-2026-92019
Name of the Vulnerable Software and Affected Versions phosphor-net-ipmid affected versions not specified Description A logic flaw in the IPMI implementation of OpenBMC allows the authorization context of an active session to be replaced with a target account. This occurs while the original...