CosmicRakp

CosmicRakp Table of Contents Introduction CVE-2013-4786 Installation Usage Credits License Introduction CosmicRakp is a powerful tool written in Go that allows red teamers and penetration testers to dump IPMI hashes. This project aims to be efficient, fast, and easy to use. CVE-2013-4786 This too...

CVE-2026-65220

A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges...

CVE-2026-65219

A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands...

CVE-2026-65220

A logic flaw in the BMC IPMI implementation of Supermicro products allows an attacker to escalate an account to administrator privileges . This vulnerability is triggered by sending specially crafted RAKP+ messages . No specific exploit details or remediation steps are provided in the documents.

EUVD-2026-110636

A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges...

CVE-2026-65219

A flaw in the BMC RAKP+ implementation on Supermicro hardware allows an attacker to send a request followed by a specially crafted RAKP message. This vulnerability enables the attacker to establish an RMCP+ session , which can then be used to execute commands . The root cause is identified as an ...

EUVD-2026-110635

A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands...

CVE-2026-16141

OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed...

CVE-2026-16141

OpenBMC's IPMI implementation, phosphor-net-ipmid , contains a logic flaw allowing an unauthenticated client to bypass RAKP authentication. An attacker can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults, causing the service to acce...

CVE-2026-16141 OpenBMC IPMI Authentication Bypass via Default userKey and Stale Challenge Value

OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed...

EUVD-2026-78573

OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed...

CVE-2026-16141 OpenBMC IPMI Authentication Bypass via Default userKey and Stale Challenge Value

OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed...

CVE-2026-16141 OpenBMC IPMI Authentication Bypass via Default userKey and Stale Challenge Value

OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed...

CVE-2026-16140 OpenBMC IPMI Privilege Escalation via Retargeted RAKP 1

OpenBMC's IPMI implementation, phosphor-net-ipmid, is vulnerable to a logic flaw where the authorization context of an existing session can be replaced with a target account while still maintaining the original integrity and encryption keys. Several downstream vendors implement phosphor-net-ipmid...

CVE-2026-16140 OpenBMC IPMI Privilege Escalation via Retargeted RAKP 1

OpenBMC's IPMI implementation, phosphor-net-ipmid, is vulnerable to a logic flaw where the authorization context of an existing session can be replaced with a target account while still maintaining the original integrity and encryption keys. Several downstream vendors implement phosphor-net-ipmid...

CVE-2026-16140 OpenBMC IPMI Privilege Escalation via Retargeted RAKP 1

OpenBMC's IPMI implementation, phosphor-net-ipmid, is vulnerable to a logic flaw where the authorization context of an existing session can be replaced with a target account while still maintaining the original integrity and encryption keys. Several downstream vendors implement phosphor-net-ipmid...

CVE-2026-16141: Use of Hard-coded Credentials

OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed...

PT-2026-92020

OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed...

EUVD-2013-3968

Malware in sbrugna...

IPMI 2.0 RAKP Remote SHA1 Password Hash Retrieval

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'IPMI 2.0 RAKP Remote SHA1 Password Hash Retrieval', 'Description' = %q| This module identifies IPMI 2.0-compatible systems and attempts to retrie...