https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 16:03:56 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-368643 EUVD-2026-368643 https://cve.radiocsirt.org/vuln/euvd-2026-368643 https://cve.radiocsirt.org/vuln/fkie_cve-2026-16141 <p>OpenBMC&#39;s IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object&#39;s constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed with the constant 20-byte &#39;userKey&#39; initialized from the string &#39;0penBmc&#39; and an often-predictable &#39;bmcRandomNum&#39;. Several downstream vendors implement phosphor-net-ipmid as their IPMI stack, such as NVIDIA and H3C.</p> <p>OpenBMC&#39;s IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object&#39;s constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed with the constant 20-byte &#39;userKey&#39; initialized from the string &#39;0penBmc&#39; and an often-predictable &#39;bmcRandomNum&#39;. Several downstream vendors implement phosphor-net-ipmid as their IPMI stack, such as NVIDIA and H3C.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-16141 https://cve.radiocsirt.org/vuln/ghsa-28w7-pg33-g2hj <p>OpenBMC&#39;s IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object&#39;s constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed with the constant 20-byte &#39;userKey&#39; initialized from the string &#39;0penBmc&#39; and an often-predictable &#39;bmcRandomNum&#39;. Several downstream vendors implement phosphor-net-ipmid as their IPMI stack, such as NVIDIA and H3C.</p> <p>OpenBMC&#39;s IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object&#39;s constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed with the constant 20-byte &#39;userKey&#39; initialized from the string &#39;0penBmc&#39; and an often-predictable &#39;bmcRandomNum&#39;. Several downstream vendors implement phosphor-net-ipmid as their IPMI stack, such as NVIDIA and H3C.</p> https://cve.radiocsirt.org/vuln/ghsa-28w7-pg33-g2hj