Supermicro BMC (IPMI cipher suite 0): Authentication bypass

Impact

Authentication bypass — arbitrary IPMI commands with any password when cipher suite 0 is enabled. Still shipped enabled on some ODM builds a decade later

Who can reach it

Network / IPMI over LAN

What to do

Disable cipher suite 0 in BMC config fleet-wide and assert it in a config scan; not fixable by firmware alone since it is a spec-permitted mode

References

Related entries

• Dell iDRAC (IPMI 1.5 cipher 0): Remote authentication bypass via cipher suite 0CVE-2013-4783 · Dell iDRAC (IPMI 1.5 cipher 0)Critical
• HPE iLO (IPMI cipher 0): IPMI authentication bypass via cipher suite 0 on the iLO BMCCVE-2013-4784 · HPE iLO (IPMI cipher 0)Critical
• Raritan PX rack PDU (before firmware 1.5.11, DPXR20A-16 and related PX models): The PDU's IPMI interface acceptsCVE-2014-2955 · Raritan PX rack PDU (before firmware 1.5.11, DPXR20A-16 and related PX models)Critical
• Supermicro BMC virtual media (H11/H12/M11/X9/X10/X11): Virtual media service uses weak/absent encryptionCVE-2019-16649 · Supermicro BMC virtual media (H11/H12/M11/X9/X10/X11)Critical
• Supermicro X10/X11 BMC (virtual media service): The BMC's virtual media service reuses socket file descriptors, soCVE-2019-16650 · Supermicro X10/X11 BMC (virtual media service)Critical
• Lanner IAC-AST2500A BMC standard firmware 1.10.0: Arbitrary code execution as root on the BMC, at the maximum severityCVE-2021-26728 · Lanner IAC-AST2500A BMC standard firmware 1.10.0Critical