CVE Feed

    Dashboard / CVE / CVE-2014-0860

    CVE-2014-0860

    The firmware before 3.66E in IBM BladeCenter Advanced Management Module (AMM), the firmware before 1.43 in IBM Integrated Management Module (IMM), and the firmware before 4.15 in IBM Integrated Management Module II (IMM2) contains cleartext IPMI credentials, which allows attackers to execute arbitrary IPMI commands, and consequently establish a blade remote-control session, by leveraging access to (1) the chassis internal network or (2) the Ethernet-over-USB interface.

    Published:Jul 7, 2014
    Last Modified:Apr 12, 2025
    EPS:Jul 7, 2014
    EPSS Score:0.00236
    CVSS Score:5

    Affected Products

    Vendor
    Ibm
    Product
    Advanced Management Module
    Vendor
    Ibm
    Product
    Advanced Management Module Firmware
    Vendor
    Ibm
    Product
    Integrated Management Module
    Vendor
    Ibm
    Product
    Integrated Management Module Firmware
    Vendor
    Ibm
    Product
    Integrated Management Module Ii
    Vendor
    Ibm
    Product
    Integrated Management Module Ii Firmware

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2016-8232 (CVSS 6.1) — Document Object Model-(DOM) based cross-site scripting vulnerability in the Advanced Management Module (AMM) v…
    CVE-2013-4007 (CVSS 3.5) — Cross-site scripting (XSS) vulnerability in adv_sw.php in the Advanced Management Module (AMM) with firmware B…
    CVE-2010-2654 (CVSS 4.3) — Multiple cross-site scripting (XSS) vulnerabilities on the IBM BladeCenter with Advanced Management Module (AM…
    CVE-2010-2656 (CVSS 5) — The IBM BladeCenter with Advanced Management Module (AMM) firmware build ID BPET48L, and possibly other versio…
    CVE-2010-2655 (CVSS 4) — Directory traversal vulnerability in private/file_management.php on the IBM BladeCenter with Advanced Manageme…
    CVE-2010-1460 (CVSS 5) — The IBM BladeCenter with Advanced Management Module (AMM) firmware before bpet50g does not properly perform in…
    CVE-2009-1290 (CVSS 6.8) — Multiple cross-site request forgery (CSRF) vulnerabilities in the web administration interface in the Advanced…
    CVE-2009-1289 (CVSS 4) — private/login.ssi in the Advanced Management Module (AMM) on the IBM BladeCenter, including the BladeCenter H …
    CVE-2009-1288 (CVSS 4.3) — Multiple cross-site scripting (XSS) vulnerabilities in the Advanced Management Module (AMM) on the IBM BladeCe…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High