CVE-2026-16141

Name of the Vulnerable Software and Affected Versions phosphor-net-ipmid (affected versions not specified)

Description A logic flaw in the IPMI implementation allows an unauthenticated client to force the RAKP Message 1 handler to return before the authentication object's constructor defaults are overwritten. Consequently, the IPMI service accepts a RAKP Message 3 where the HMAC is calculated using a predictable bmcRandomNum and a constant 20-byte userKey initialized as '0penBmc'. This issue affects OpenBMC and downstream vendors using phosphor-net-ipmid as their IPMI stack, including NVIDIA and H3C.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.