Ibm Openbmc vulnerabilities
10 known vulnerabilities affecting ibm/openbmc.
Total CVEs
10
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
HIGH4MEDIUM5LOW1
Vulnerabilities
Page 1 of 1
CVE-2026-7868P3HIGHCVSS 8.8≥ FW1110.00, ≤ FW1110.20≥ FW1060.00, ≤ FW1060.712026-07-28
CVE-2026-7868 [HIGH] CWE-863 CVE-2026-7868: IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows ReadOnly users to es
IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows ReadOnly users to escalate privileges and give themselves administrator privileges.
nvd
CVE-2024-31916P3HIGHCVSS 7.5≥ fw1050.00, ≤ fw1050.10≥ FW1050.00, ≤ FW1050.102024-06-27
CVE-2024-31916 [HIGH] CWE-288 CVE-2024-31916: IBM OpenBMC FW1050.00 through FW1050.10 BMCWeb HTTPS server component could disclose sensitive URI c
IBM OpenBMC FW1050.00 through FW1050.10 BMCWeb HTTPS server component could disclose sensitive URI content to an unauthorized actor that bypasses authentication channels. IBM X-ForceID: 290026.
nvd
CVE-2021-38960P3HIGHCVSS 7.5vOP920vOP930+1 more2022-02-04
CVE-2021-38960 [HIGH] CWE-200 CVE-2021-38960: IBM OPENBMC OP920, OP930, and OP940 could allow an unauthenticated user to obtain sensitive informat
IBM OPENBMC OP920, OP930, and OP940 could allow an unauthenticated user to obtain sensitive information. IBM X-Force ID: 212047.
nvd
CVE-2024-35124P3HIGHCVSS 7.5≥ fw1020.00, ≤ fw1020.60≥ fw1030.00, ≤ fw1030.50+4 more2024-08-13
CVE-2024-35124 [HIGH] CWE-288 CVE-2024-35124: A vulnerability in the combination of the OpenBMC's FW1050.00 through FW1050.10, FW1030.00 through F
A vulnerability in the combination of the OpenBMC's FW1050.00 through FW1050.10, FW1030.00 through FW1030.50, and FW1020.00 through FW1020.60 default password and session management allow an attacker to gain administrative access to the BMC. IBM X-Force ID: 290674.
nvd
CVE-2026-18849P3MEDIUMCVSS 6.8≥ fw1060.00, ≤ fw1060.80≥ FW1060.00, ≤ FW1060.802026-08-19
CVE-2026-18849 [MEDIUM] CWE-22 CVE-2026-18849: IBM OpenBMC FW1060.00 through FW1060.80 is affected by a vulnerability in the BMC firmware update pr
IBM OpenBMC FW1060.00 through FW1060.80 is affected by a vulnerability in the BMC firmware update process. An attacker with authenticated administrator-level access to the BMC can, under specific conditions, execute arbitrary code, resulting in a confidentiality, integrity, and availability impact.
nvd
CVE-2026-8058P4MEDIUMCVSS 4.9≥ FW1110.00, ≤ FW1110.20≥ FW1060.00, ≤ FW1060.712026-07-28
CVE-2026-8058 [MEDIUM] CWE-200 CVE-2026-8058: IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows a user to supply a p
IBM OPENBMC FW1110.00 through FW1110.20, and FW1060.00 through FW1060.71 allows a user to supply a password with a resource dump request stores that password into the BMC audit log where an admin user can see it.
nvd
CVE-2021-38961P4MEDIUMCVSS 6.1vOP9102021-12-27
CVE-2021-38961 [MEDIUM] CWE-79 CVE-2021-38961: IBM OPENBMC OP910 is vulnerable to cross-site scripting. This vulnerability allows users to embed ar
IBM OPENBMC OP910 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 212049.
nvd
CVE-2026-7254P4MEDIUMCVSS 5.3≥ 1110.00, ≤ 1110.11≥ FW1110.00, ≤ FW1110.112026-05-27
CVE-2026-7254 [MEDIUM] CWE-1284 CVE-2026-7254: IBM OPENBMC FW1110.00 through FW1110.11 is vulnerable to denial of service attacks by unauthenticate
IBM OPENBMC FW1110.00 through FW1110.11 is vulnerable to denial of service attacks by unauthenticated network users.
nvd
CVE-2022-22488P4MEDIUMCVSS 4.9vOP910, OP9402022-12-12
CVE-2022-22488 [MEDIUM] CWE-770 CVE-2022-22488: IBM OpenBMC OP910 and OP940 could allow a privileged user to cause a denial of service by uploading
IBM OpenBMC OP910 and OP940 could allow a privileged user to cause a denial of service by uploading or deleting too many CA certificates in a short period of time. IBM X-Force ID: 2226337.
nvd
CVE-2026-18857P4LOWCVSS 3.4≥ FW1120.00, ≤ FW1120.01≥ FW1110.00, ≤ FW1110.31+1 more2026-09-24
CVE-2026-18857 [LOW] CWE-125 CVE-2026-18857: IBM OPENBMC FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.8
IBM OPENBMC FW1120.00 through FW1120.01, FW1110.00 through FW1110.31, and FW1060.00 through FW1060.81 is affected by a vulnerability in the BMC firmware management interface. The host system can cause the BMC firmware management service to crash or allow a limited amount of BMC internal memory to be read, resulting in a confidentiality and availability
nvd