VULNERABILITY INTELLIGENCE
CVE-2024-3411
CVSS score9.1 CRITICAL
EPSS probability0.72%
CISA KEVNot currently listed
Published2024-04-30
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Description
Implementations of IPMI Authenticated sessions does not provide enough randomness to protect from session hijacking, allowing an attacker to use either predictable IPMI Session ID or weak BMC Random Number to bypass security controls using spoofed IPMI packets to manage BMC device.
Weakness classification
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-331