CVE-2018-9068 Hardcoded credentials in System x IMM2
Hard-coded SFTP credentials in IMM2 allow attackers with management network access to download diagnostic logs and FFDC data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-9068?
CVE-2018-9068 is a high-severity vulnerability in IBM Corporation System x IMM2, published on 26 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is made available for download through an SFTP server hosted on the IMM2 management network interface. In versions earlier than 4.90 for Lenovo System x and earlier than 6.80 for IBM System x, the credentials to access the SFTP server are hard-coded and described in the IMM2 documentation, allowing an attacker with management network access to obtain the collected FFDC data. After applying the update, the IMM2 will create random SFTP credentials for use with OneCLI.
Weakness: CWE-798
Which versions are affected by CVE-2018-9068?
It affects 42 products.
Products include Ibm Bladecenter Hs22 Firmware, Ibm Bladecenter Hs23 Firmware, Ibm Bladecenter Hs23e Firmware, Ibm Flex System X220 M4 Firmware, Ibm Flex System X222 M4 Firmware, Ibm Flex System X240 M4 Firmware and 36 more.
How do I fix CVE-2018-9068?
No fix has been published for CVE-2018-9068 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-9068 being exploited?
There is no known exploitation of CVE-2018-9068 in the wild and no public exploit code.
Other vulnerabilities in IBM Corporation System x IMM2
Sources
Also known as GHSA-q3h5-wxx8-7xc8.