← Back

CVE-2024-35124

nvd nist
Published: Aug 13, 2024Modified: Jun 17, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Exploitability: 1.6 / Impact: 5.9
Source: NVD

Description

A vulnerability in the combination of the OpenBMC's FW1050.00 through FW1050.10, FW1030.00 through FW1030.50, and FW1020.00 through FW1020.60 default password and session management allow an attacker to gain administrative access to the BMC. IBM X-Force ID: 290674.

Affected (3)

Products: Ibm: Openbmc
Ibm
1 product
Openbmc
Configuration A
3 vulnerable
Vulnerable SoftwareAffected Versions
Ibm
Openbmc
From fw1020.00 to fw1020.60
Openbmc
From fw1030.00 to fw1030.50
Openbmc
From fw1050.00 to fw1050.10

Related CWEs

CWE-288
Authentication Bypass Using an Alternate Path or Channel
A product requires authentication, but the product has an alternate path or channel that does not require authentication.
CWE-306
Missing Authentication for Critical Function
The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

Source: psirt@us.ibm.com
VDB EntryVendor Advisory
Source: psirt@us.ibm.com
Vendor Advisory

Timeline

No history available yet.