IPMI over LAN as a protocol: IPMI has no transport confidentiality guarantees worth relying on, weak session handling

NCVD-0000-002-ipmi-over-lan-as-a-protocolFirmware, BMC & network fabriccurated

Impact

IPMI has no transport confidentiality guarantees worth relying on, weak session handling, and per-vendor implementations that diverge from spec. Every BMC on the fleet speaks it by default

Who can reach it

Network, management VLAN

What to do

Fleet policy decision to disable IPMI-over-LAN and force Redfish-only; costs a rewrite of provisioning/monitoring tooling and loses compatibility with older ODM chassis

References

https://nvd.nist.gov/vuln/detail/CVE-2013-4786

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.