High severity · published Aug 13, 2024
CVE-2024-35124
A vulnerability in the combination of the OpenBMC's FW1050.00 through FW1050.10, FW1030.00 through FW1030.50, and FW1020.00 through FW1020.60 default password and session…
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability in the combination of the OpenBMC's FW1050.00 through FW1050.10, FW1030.00 through FW1030.50, and FW1020.00 through FW1020.60 default password and session management allow an attacker to gain administrative access to the BMC. IBM X-Force ID: 290674.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 43% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Openbmc · Ibm
fw1020.00 through fw1020.60; fw1030.00 through fw1030.50; fw1050.00 through fw1050.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-35124
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-35124
VDB Entry
https://https://exchange.xforce.ibmcloud.com/vulnerabilities/290674
Vendor Advisory
https://www.ibm.com/support/pages/node/7163195
More from Openbmc
8.8
CVE-2026-7868
This Power System update is being released to address incorrect authorization
7.5
CVE-2024-31916
IBM OpenBMC FW1050.00 through FW1050.10 BMCWeb HTTPS server component could disclose sensitive URI content to an unauthorized actor that bypasses authentication channels
6.8
CVE-2026-18849
IBM OpenBMC Code Execution
5.3
CVE-2026-7254
Open BMC Denial of Service
4.9
CVE-2026-8058
This Power System update is being released to address a sensitive information disclosure