Executive brief
OpenBMC's phosphor-net-ipmid is a network-accessible IPMI implementation used by server manufacturers like NVIDIA and H3C to provide out-of-band management capabilities. A logic flaw allows unauthenticated attackers to bypass IPMI authentication by exploiting predictable challenge values and a hardcoded default password, potentially granting unauthorized access to critical server management functions and sensitive data.
Technical details
The vulnerability is an authentication bypass in the RAKP (Remote Authentication Kernel Protocol) message handling. An unauthenticated client can force the RAKP Message 1 handler to return prematurely, preventing the authentication object from overwriting its constructor defaults. The service then incorrectly accepts a RAKP Message 3 whose HMAC is computed using a constant 20-byte 'userKey' derived from the hardcoded string '0penBmc' and an often-predictable 'bmcRandomNum'. This allows an attacker on the network to forge valid authentication credentials without knowledge of the actual user password. No authentication is required to exploit this flaw; network access to the IPMI service is sufficient.
Affected products
- OpenBMC phosphor-net-ipmid
Timeline
- 2026-09-15: disclosed