IBM OpenBMC authentication bypass

published 2024-08-13 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-35201

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 43%
public exploits: 0; none known

A vulnerability in the combination of the OpenBMC's FW1050.00 through FW1050.10, FW1030.00 through FW1030.50, and FW1020.00 through FW1020.60 default password and session management allow an attacker to gain administrative access to the BMC. IBM X-Force ID: 290674.

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 y ago (2024-08-13)

Exploit prediction

0.51% chance of exploitation in the next 30 days, higher than 43% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

IBM OpenBMC

Classification

Weakness

CWE-288 Authentication Bypass Using an Alternate Path or Channel
CWE-306 Missing Authentication for Critical Functionality

References

ibm.com /support/pages/node/7163195
vendor-advisory
https //exchange.xforce.ibmcloud.com/vulnerabilities/290674
vdb-entry, vendor-advisory

Sources

CVE List CVE-2024-35124
NVD CVE-2024-35124

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary