CVE-2021-39296

In OpenBMC 2.9, crafted IPMI messages allow an attacker to bypass authentication and gain full control of the system.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
10 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 26%
VendorProductVersion
openbmc-projectopenbmc
2.9.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/google/security-research/security/advisories/GHSA-gg9x-v835-m48q
https://github.com/openbmc/openbmc
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00737.html
https://github.com/google/security-research/security/advisories/GHSA-gg9x-v835-m48q
https://github.com/openbmc/openbmc
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00737.html