CVE-2023-32280 Hardcoded credentials in Intel(R) Server Product OpenBMC firmware
Unauthenticated attackers can access sensitive information due to insufficiently protected credentials in Intel Server OpenBMC firmware.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-32280?
CVE-2023-32280 is a medium-severity vulnerability in Intel(R) Server Product OpenBMC firmware, published on 14 Feb 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Insufficiently protected credentials in some Intel(R) Server Product OpenBMC firmware before versions egs-1.05 may allow an unauthenticated user to enable information disclosure via network access.
Weakness: CWE-522
Which versions are affected by CVE-2023-32280?
It affects 1 product.
Products include Intel Openbmc.
How do I fix CVE-2023-32280?
No fix has been published for CVE-2023-32280 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-32280 being exploited?
There is no known exploitation of CVE-2023-32280 in the wild and no public exploit code.
Other vulnerabilities in Intel(R) Server Product OpenBMC firmware
Sources
Also known as GHSA-fmp2-6gj7-cwpc.