CVE-2021-39296

EUVD-2021-25657
In OpenBMC 2.9, crafted IPMI messages allow an attacker to bypass authentication and gain full control of the system.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
10 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 26%
Affected Products (NVD)
VendorProductVersion
openbmc-projectopenbmc
2.9.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/google/security-research/security/advisories/GHSA-gg9x-v835-m48q
https://github.com/openbmc/openbmc
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00737.html
https://github.com/google/security-research/security/advisories/GHSA-gg9x-v835-m48q
https://github.com/openbmc/openbmc
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00737.html