Database/Firmware, BMC & network fabric
Redfish implementations (all vendors): Redfish replaced IPMI but reintroduced the same class of flaws at the HTTP layer
UnscoredNCVD-0000-009-redfish-implementations-all-vendFirmware, BMC & network fabriccurated
Impact
Redfish replaced IPMI but reintroduced the same class of flaws at the HTTP layer — CVE-2024-54085, CVE-2023-34330, CVE-2023-25191/25192, CVE-2018-15774 are all Redfish-surface bugs. The spec mandates no minimum implementation assurance, and every ODM ships its own stack
Who can reach it
Network / management VLAN
What to do
Treat Redfish as an untrusted-by-default surface: mTLS or a management-plane proxy in front of every BMC, per-node unique credentials, and no direct operator access. This is architecture work, not patching
References
Related entries
- KVM-over-IP / virtual media: The BMC's virtual-media function can mount an arbitrary ISO as the host's boot deviceNCVD-0000-010-kvm-over-ip-virtual-media · KVM-over-IP / virtual mediaUnscored
- Serial console servers / out-of-band access appliances: Console servers (Opengear, Lantronix, Digi and similar) holdNCVD-0000-011-serial-console-servers-out-of-ba · Serial console servers / out-of-band access appliancesUnscored
- ATA Secure Erase / NVMe Sanitize / Format NVM across SSD vendorsNCVD-2011-001-ata-secure-erase-nvme-sanitize-f · ATA Secure Erase / NVMe Sanitize / Format NVM across SSD vendors - drives that report sanitization success while…Unscored
- ATA Secure Erase / NVMe Sanitize / Format NVM across SSD vendorsNCVD-2011-002-ata-secure-erase-nvme-sanitize-f · ATA Secure Erase / NVMe Sanitize / Format NVM across SSD vendors - drives that report sanitization success while…Unscored
- HDD and SSD controller firmware as a persistence surfaceNCVD-2015-001-hdd-and-ssd-controller-firmware · HDD and SSD controller firmware as a persistence surface - demonstrated against Seagate, Western Digital, Toshiba…Unscored
- HDD and SSD controller firmware as a persistence surfaceNCVD-2015-002-hdd-and-ssd-controller-firmware · HDD and SSD controller firmware as a persistence surface - demonstrated against Seagate, Western Digital, Toshiba…Unscored
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.