Unscored severity · published Jul 7, 2014
CVE-2014-0860
The firmware before 3.66E in IBM BladeCenter Advanced Management Module (AMM), the firmware before 1.43 in IBM Integrated Management Module (IMM), and the firmware before 4.15 in…
–
CVSS
1%
EPSS
No
On KEV
Description
The firmware before 3.66E in IBM BladeCenter Advanced Management Module (AMM), the firmware before 1.43 in IBM Integrated Management Module (IMM), and the firmware before 4.15 in IBM Integrated Management Module II (IMM2) contains cleartext IPMI credentials, which allows attackers to execute arbitrary IPMI commands, and consequently establish a blade remote-control session, by leveraging access to (1) the chassis internal network or (2) the Ethernet-over-USB interface.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 62% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AM
Advanced Management Module · Ibm
All versions, or not specified · source: NVD
AM
Advanced Management Module Firmware · Ibm
through 3.65 · source: NVD
IM
Integrated Management Module · Ibm
All versions, or not specified · source: NVD
IM
Integrated Management Module Firmware · Ibm
through 1.36 · source: NVD
IM
Integrated Management Module II · Ibm
All versions, or not specified · source: NVD
IM
Integrated Management Module II Firmware · Ibm
through 3.65 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-0860
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-0860
Vendor Advisory
http://www.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5095840
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/90880
More from Advanced Management Module
–
CVE-2013-4007
Cross-site scripting (XSS) vulnerability in adv_sw.php in the Advanced Management Module (AMM) with firmware BBET before BBET64G and BPET before BPET64G for IBM BladeCenter…
–
CVE-2010-2656
The IBM BladeCenter with Advanced Management Module (AMM) firmware build ID BPET48L, and possibly other versions before 4.7 and 5.0, stores sensitive information under the web…
–
CVE-2010-2655
Directory traversal vulnerability in private/file_management.php on the IBM BladeCenter with Advanced Management Module (AMM) firmware build ID BPET48L, and possibly other…
–
CVE-2010-2654
Multiple cross-site scripting (XSS) vulnerabilities on the IBM BladeCenter with Advanced Management Module (AMM) firmware build ID BPET48L, and possibly other versions before 4.7…
–
CVE-2010-1460
The IBM BladeCenter with Advanced Management Module (AMM) firmware before bpet50g does not properly perform interrupt sharing for USB and iSCSI, which allows remote attackers to…