CVE-2026-16141
OpenBMC's IPMI implementation, phosphor-net-ipmid, contains a logic flaw in which an unauthenticated client can force the RAKP Message 1 handler to return before it overwrites the authentication object's constructor defaults. The IPMI service then accepts a RAKP Message 3 whose HMAC is computed with the constant 20-byte 'userKey' initialized from the string '0penBmc' and an often-predictable 'bmcRandomNum'. Several downstream vendors implement phosphor-net-ipmid as their IPMI stack, such as NVIDIA and H3C.
Scoring
- Severity
- HIGH
- CVSS base score
- 8.1
- CVSS vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS probability
- 0.39%
- CWE
- CWE-798, CWE-457
- Published
- 2026-09-15
- Last modified
- 2026-09-15
Affected products
- OpenBMC phosphor-net-ipmid
Weakness type
Related vulnerabilities
- CVE-2026-22769 — Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. Thi
- CVE-2026-27507 — Binardat 10G08-0800GSM Network Switch Hard-coded Credentials
- CVE-2026-25803 — 3DP-MANAGER Uses Hard-coded Credentials
- CVE-2026-24448 — Use of hard-coded credentials issue exists in MR-GM5L-S1 and MR-GM5A-L1, which may allow an attacker to obtain administr
- CVE-2026-23647 — Glory RBG-100 Recycler System Hard-coded OS Credentials
- CVE-2025-9497 — Hardcoded Upgrade Decryption Passwords
- CVE-2020-37135 — AMSS++ 4.7 - Backdoor Admin Account
- CVE-2020-37092 — Netis E1+ 1.2.32533 - Backdoor Account (root)