Openbmc - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/openbmc/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 15 Sep 2026 15:31:02 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPrivilege Escalation Vulnerability in OpenBMC phosphor-net-ipmid (CVE-2026-16140)https://feed.craftedsignal.io/briefs/2026-09-openbmc-privilege-escalation/Tue, 15 Sep 2026 15:31:02 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-openbmc-privilege-escalation/A logic flaw in OpenBMC's phosphor-net-ipmid implementation allows authenticated remote attackers to hijack existing sessions and perform unauthorized privilege escalation.OpenBMC's IPMI implementation, phosphor-net-ipmid, is vulnerable to a critical logic flaw (CVE-2026-16140) in its Remote Authentication and Key Exchange (RAKP) mechanism. An attacker who has already established a low-privilege session can trigger this vulnerability to replace their current authorization context with that of a target account, such as an administrator, without requiring re-authentication. The vulnerability persists because the session maintains the original integrity and encryption keys even after the authorization context is swapped. This flaw poses a significant risk to data center infrastructure, as OpenBMC is widely utilized in server management stacks by various vendors, including NVIDIA and H3C. Given the availability of public proof-of-concept exploit code, administrators should prioritize identifying and patching impacted BMC firmware.

Impact

Successful exploitation of CVE-2026-16140 allows an attacker to achieve full unauthorized control over the baseboard management controller (BMC), leading to complete loss of confidentiality, integrity, and availability of the managed server hardware. This vulnerability affects downstream vendors integrating OpenBMC, impacting enterprise, cloud, and high-performance computing environments where IPMI is exposed to the management network.

Recommendation

  • Identify all servers running OpenBMC-based firmware within your environment using internal asset management or vulnerability scanning tools.
  • Review the advisories from your specific hardware vendors (such as NVIDIA or H3C) for firmware updates that address CVE-2026-16140.
  • Apply the vendor-provided firmware patches to all vulnerable BMCs immediately.
  • Restrict access to the IPMI/BMC management network to authorized management subnets and jump hosts to limit exposure.
]]>highadvisoryprivilege-escalationipmiopenbmc