CVE-2024-35124: IBM OpenBMC authentication bypass

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-08-13 · updated 2026-06-17
Weakness: CWE-288

Description

A vulnerability in the combination of the OpenBMC's FW1050.00 through FW1050.10, FW1030.00 through FW1030.50, and FW1020.00 through FW1020.60 default password and session management allow an attacker to gain administrative access to the BMC. IBM X-Force ID: 290674.

Affected products

IBM OPENBMC: from fw1020.00 through fw1020.60; from fw1030.00 through fw1030.50; from fw1050.00 through fw1050.10

References

https://https://exchange.xforce.ibmcloud.com/vulnerabilities/290674
https://www.ibm.com/support/pages/node/7163195

Get alerted when CVE-2024-35124 or the next vulnerability affects your stack