CVE-2004-2600
Last modified
CVE-2004-2600 is a vulnerability of currently unknown severity. The firmware for Intelligent Platform Management Interface (IPMI) 1.5-based Intel Server Boards and Platforms is shipped with an Authentication Type Enables parameter set to an invalid None parameter, which allows remote attackers to obtain sensitive information when LAN management functionality is enabled.. EPSS estimates a 2.63% chance of exploitation in the next 30 days.
Description
The firmware for Intelligent Platform Management Interface (IPMI) 1.5-based Intel Server Boards and Platforms is shipped with an Authentication Type Enables parameter set to an invalid None parameter, which allows remote attackers to obtain sensitive information when LAN management functionality is enabled.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Intel | Cli Auto-Configuration Utility | All versions |
| Intel | Client System Setup Utility | All versions |
| Intel | Server Configuration Wizard | All versions |
| Intel | Server Control | All versions |
| Intel | System Setup Utility | All versions |
| Intel | Carrier Grade Server Tigpr2u | All versions |
| Intel | Carrier Grade Server Tsrlt2 | All versions |
| Intel | Carrier Grade Server Tsrmt2 | All versions |
| Hp | Carrier Grade Server Cc2300 | a6898a |
| Hp | Carrier Grade Server Cc2300 | a6899a |
| Hp | Carrier Grade Server Cc3300 | a6900a |
| Hp | Carrier Grade Server Cc3300 | a6901a |
| Hp | Carrier Grade Server Cc3310 | a9862a |
| Hp | Carrier Grade Server Cc3310 | a9863a |
| Intel | Entry Server Board Se7210tp1-E | All versions |
| Intel | Entry Server Platform Sr1325tp1-E | All versions |
| Intel | Server Board Scb2 | All versions |
| Intel | Server Board Sds2 | All versions |
| Intel | Server Board Se7500wv2 | All versions |
| Intel | Server Board Se7501hg2 | All versions |
| Intel | Server Board Shg2 | All versions |
| Intel | Server Platform Spsh4 | All versions |
| Intel | Server Platform Sr870bh2 | All versions |
| Intel | Server Platform Sr870bn4 | All versions |
| Intel | Server Platform Srsh4 | All versions |
References
- http://secunia.com/advisories/11315Patch, Vendor Advisory
- http://secunia.com/advisories/11315Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2004-2600?
How severe is CVE-2004-2600?
How do I fix CVE-2004-2600?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2004
- CVE-2004-2594Absolute path traversal vulnerability in Quake II server bef…
- CVE-2004-2595Absolute path traversal vulnerability in Quake II server bef…
- CVE-2004-2596Quake II server before R1Q2, as used in multiple products, a…
- CVE-2004-2597Quake II server before R1Q2, as used in multiple products, a…
- CVE-2004-2598Quake II server before R1Q2, as used in multiple products, a…
- CVE-2004-2599Multiple buffer overflows in Quake II server before R1Q2, as…
- CVE-2004-2601PHP remote file inclusion vulnerability in UberTec Help Cent…
- CVE-2004-2602PHP remote file inclusion vulnerability in UberTec Help Cent…
- CVE-2004-2603Cross-site scripting (XSS) vulnerability in the Search modul…
- CVE-2004-2604Cross-site scripting (XSS) vulnerability in index.php in PHP…
- CVE-2004-2605aStats 1.6.5 allows local users to overwrite arbitrary files…
- CVE-2004-2606The Web interface in Linksys WRT54G 2.02.7 and BEFSR41 versi…
Are you affected by CVE-2004-2600?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST