CVE-2024-3411
Insufficient Randomness When Validating an IPMI Authenticated Session
- State
- Published
- Severity
- 9.1 Critical
- Published
- Apr 30, 2024
- Updated
- Nov 4, 2025
- Reserved
- Apr 5, 2024
Description
Implementations of IPMI Authenticated sessions does not provide enough randomness to protect from session hijacking, allowing an attacker to use either predictable IPMI Session ID or weak BMC Random Number to bypass security controls using spoofed IPMI packets to manage BMC device.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.1 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N | CISA-ADP |
Weaknesses
- CWE-331 Insufficient Entropy
Affected Products
| Product | Versions |
|---|---|
iDRAC8Dell |
|
IPMIIntel |
|
References
- https://kb.cert.org/vuls/id/163057
- https://www.intel.la/content/dam/www/public/us/en/documents/specification-updates/ipmi-intelligent-platform-mgt-interface-spec-2nd-gen-v2-0-spec-update.pdf
- https://www.dell.com/support/kbdoc/en-US/000226504/dsa-2024-295-security-update-for-dell-idrac8-ipmi-session-vulnerability
- https://www.kb.cert.org/vuls/id/163057
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.