Gadi Evron

**Name of the Vulnerable Software and Affected Versions** phosphor-net-ipmid (affected versions not specified) **Description** A logic flaw in the IPMI implementation of OpenBMC allows the authorization context of an active session to be replaced with a target account. This occurs while the original integrity and encryption keys remain active, enabling privilege escalation without the need for re-authentication. This implementation is used by several downstream vendors, including NVIDIA and H3C. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** phosphor-net-ipmid (affected versions not specified) **Description** A logic flaw in the IPMI implementation allows an unauthenticated client to force the RAKP Message 1 handler to return before the authentication object's constructor defaults are overwritten. Consequently, the IPMI service accepts a RAKP Message 3 where the HMAC is calculated using a predictable `bmcRandomNum` and a constant 20-byte `userKey` initialized as '0penBmc'. This issue affects OpenBMC and downstream vendors using phosphor-net-ipmid as their IPMI stack, including NVIDIA and H3C. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cisco Security Monitoring, Analysis and Response System (CS-MARS) versions prior to 4.1.3 **Description** The issue concerns an undocumented administrative account with a default password. This allows local users to gain privileges via the expert command. **Recommendations** For versions prior to 4.1.3, update to version 4.1.3 or later to resolve the issue.