CVE-2024-45656 - Vulnerability Details - OpenCVE

IBM Flexible Service Processor (FSP) FW860.00 through FW860.B3, FW950.00 through FW950.C0, FW1030.00 through FW1030.61, FW1050.00 through FW1050.21, and FW1060.00 through FW1060.10 has static credentials which may allow network users to gain service privileges to the FSP.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact total

Vendors	Products
Ibm	Power9 System Firmware

No data.

No data.

References

Link	Providers
https://www.ibm.com/support/pages/node/7174183

History

Tue, 29 Oct 2024 13:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 29 Oct 2024 01:00:00 +0000

Type	Values Removed	Values Added
Description		IBM Flexible Service Processor (FSP) FW860.00 through FW860.B3, FW950.00 through FW950.C0, FW1030.00 through FW1030.61, FW1050.00 through FW1050.21, and FW1060.00 through FW1060.10 has static credentials which may allow network users to gain service privileges to the FSP.
Title		IBM Flexible Service Processor hard coded credentials
First Time appeared		Ibm Ibm power9 System Firmware
Weaknesses		CWE-798
CPEs		cpe:2.3:o:ibm:power9_system_firmware:fw1030.00:::::::* cpe:2.3:o:ibm:power9_system_firmware:fw1050.00:::::::* cpe:2.3:o:ibm:power9_system_firmware:fw1060.00:::::::* cpe:2.3:o:ibm:power9_system_firmware:fw860.00:::::::* cpe:2.3:o:ibm:power9_system_firmware:fw950.00:::::::*
Vendors & Products		Ibm Ibm power9 System Firmware
References		https://www.ibm.com/support/pages/node/7174183
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: ibm

Published: 2024-10-29T00:37:16.004Z

Updated: 2024-11-02T03:55:32.353Z

Reserved: 2024-09-03T13:50:26.296Z

Link: CVE-2024-45656

Vulnrichment

Updated: 2024-10-29T12:49:47.731Z

NVD

Status : Awaiting Analysis

Published: 2024-10-29T01:15:03.823

Modified: 2024-10-29T14:34:04.427

Link: CVE-2024-45656

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-45656", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "state": "PUBLISHED", "assignerShortName": "ibm", "dateReserved": "2024-09-03T13:50:26.296Z", "datePublished": "2024-10-29T00:37:16.004Z", "dateUpdated": "2024-11-02T03:55:32.353Z"}, "containers": {"cna": {"affected": [{"cpes": ["cpe:2.3:o:ibm:power9_system_firmware:fw1060.00:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power9_system_firmware:fw1050.00:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power9_system_firmware:fw1030.00:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power9_system_firmware:fw950.00:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power9_system_firmware:fw860.00:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "product": "Flexible Service Processor", "vendor": "IBM", "versions": [{"lessThanOrEqual": "FW860.B3", "status": "affected", "version": "FW860.00", "versionType": "semver"}, {"lessThanOrEqual": "FW950.C0", "status": "affected", "version": "FW950.00", "versionType": "semver"}, {"lessThanOrEqual": "FW1030.61", "status": "affected", "version": "FW1030.00", "versionType": "semver"}, {"lessThanOrEqual": "FW1050.21", "status": "affected", "version": "FW1050.00", "versionType": "semver"}, {"lessThanOrEqual": "FW1060.10", "status": "affected", "version": "FW1060.00", "versionType": "semver"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "IBM Flexible Service Processor (FSP) FW860.00 through FW860.B3, FW950.00 through FW950.C0, FW1030.00 through FW1030.61, FW1050.00 through FW1050.21, and FW1060.00 through FW1060.10 has static credentials which may allow network users to gain service privileges to the FSP."}], "value": "IBM Flexible Service Processor (FSP) FW860.00 through FW860.B3, FW950.00 through FW950.C0, FW1030.00 through FW1030.61, FW1050.00 through FW1050.21, and FW1060.00 through FW1060.10 has static credentials which may allow network users to gain service privileges to the FSP."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2024-10-29T00:37:16.004Z"}, "references": [{"url": "https://www.ibm.com/support/pages/node/7174183"}], "source": {"discovery": "UNKNOWN"}, "title": "IBM Flexible Service Processor hard coded credentials", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-11-01T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2024-45656"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-02T03:55:32.353Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-45656", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-29T12:49:39.474068Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-29T12:49:47.731Z"}}], "cna": {"title": "IBM Flexible Service Processor hard coded credentials", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"cpes": ["cpe:2.3:o:ibm:power9_system_firmware:fw1060.00:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power9_system_firmware:fw1050.00:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power9_system_firmware:fw1030.00:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power9_system_firmware:fw950.00:*:*:*:*:*:*:*", "cpe:2.3:o:ibm:power9_system_firmware:fw860.00:*:*:*:*:*:*:*"], "vendor": "IBM", "product": "Flexible Service Processor", "versions": [{"status": "affected", "version": "FW860.00", "versionType": "semver", "lessThanOrEqual": "FW860.B3"}, {"status": "affected", "version": "FW950.00", "versionType": "semver", "lessThanOrEqual": "FW950.C0"}, {"status": "affected", "version": "FW1030.00", "versionType": "semver", "lessThanOrEqual": "FW1030.61"}, {"status": "affected", "version": "FW1050.00", "versionType": "semver", "lessThanOrEqual": "FW1050.21"}, {"status": "affected", "version": "FW1060.00", "versionType": "semver", "lessThanOrEqual": "FW1060.10"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.ibm.com/support/pages/node/7174183"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "IBM Flexible Service Processor (FSP) FW860.00 through FW860.B3, FW950.00 through FW950.C0, FW1030.00 through FW1030.61, FW1050.00 through FW1050.21, and FW1060.00 through FW1060.10 has static credentials which may allow network users to gain service privileges to the FSP.", "supportingMedia": [{"type": "text/html", "value": "IBM Flexible Service Processor (FSP) FW860.00 through FW860.B3, FW950.00 through FW950.C0, FW1030.00 through FW1030.61, FW1050.00 through FW1050.21, and FW1060.00 through FW1060.10 has static credentials which may allow network users to gain service privileges to the FSP.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials"}]}], "providerMetadata": {"orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "shortName": "ibm", "dateUpdated": "2024-10-29T00:37:16.004Z"}}}, "cveMetadata": {"cveId": "CVE-2024-45656", "state": "PUBLISHED", "dateUpdated": "2024-11-02T03:55:32.353Z", "dateReserved": "2024-09-03T13:50:26.296Z", "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522", "datePublished": "2024-10-29T00:37:16.004Z", "assignerShortName": "ibm"}, "dataVersion": "5.1"}