AMI MegaRAC: Weak MD5 password hashing for BMC accounts

CVE-2022-40258Firmware, BMC & network fabriccurated

Impact

Weak MD5 password hashing for BMC accounts; offline cracking of captured hashes

Who can reach it

Local/offline after hash disclosure

What to do

BMC firmware update plus credential rotation, since previously-hashed passwords must be considered recoverable

References

https://nvd.nist.gov/vuln/detail/CVE-2022-40258

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.