CVEvulnerability
CVE-2014-0860
5.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-07-07
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-310
Description
The firmware before 3.66E in IBM BladeCenter Advanced Management Module (AMM), the firmware before 1.43 in IBM Integrated Management Module (IMM), and the firmware before 4.15 in IBM Integrated Management Module II (IMM2) contains cleartext IPMI credentials, which allows attackers to execute arbitrary IPMI commands, and consequently establish a blade remote-control session, by leveraging access to (1) the chassis internal network or (2) the Ethernet-over-USB interface.
Affected configurations
• ibm integrated management module firmware (<= 1.36)
• ibm integrated management module
• ibm advanced management module firmware (<= 3.65)
• ibm advanced management module
• ibm integrated management module ii firmware (<= 3.65)
• ibm integrated management module ii
Related
Weakness · not in database (1)
References
- http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095840 Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90880 exchange.xforce.ibmcloud.com
- http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095840 Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/90880 exchange.xforce.ibmcloud.com