CVE-2026-16141

OpenBMC's IPMI 2.0 stack, phosphor-net-ipmid, contains a logic flaw (CWE-457 / CWE-798) where an unauthenticated network client can force the RAKP Message 1 handler to return before the authentication object's constructor defaults are overwritten. The service will then accept a RAKP Message 3 whose HMAC is computed with a hard-coded 20-byte 'userKey' built from the string '0penBmc' plus an often-predictable 'bmcRandomNum', allowing the attacker to complete the session key exchange without ever knowing a valid password. Successful exploitation yields a fully authenticated IPMI session (CVSS 3.1 base 8.1, with high impact on confidentiality, integrity, and availability), enabling actions such as sensor readout, chassis power control, and potentially BMC account manipulation on the target server. Any server BMC running OpenBMC firmware that embeds the vulnerable phosphor-net-ipmid code is affected, including downstream implementations shipped by NVIDIA and H3C. There is currently no known public proof of concept and no evidence of exploitation in the wild.

What to do: Patch to a phosphor-net-ipmid release containing the fix as soon as your vendor (NVIDIA, H3C, or other OpenBMC downstream) publishes updated BMC firmware, and track their advisories since affected versions have not been enumerated. In the interim, ensure IPMI/RMCP+ (UDP 623) is reachable only from hardened management VLANs or a jump-host, never from the internet or user subnets. Review BMC audit logs for unexplained RAKP session establishments from unfamiliar sources, and rotate BMC user credentials if compromise is suspected.