OpenBMC's phosphor-net-ipmid contains a logic flaw where an unauthenticated client can cause the RAKP Message 1 handler to return prematurely before overwriting default authentication constructor values. Consequently, the IPMI service accepts RAKP Message 3 with an HMAC computed using a constant 20-byte 'userKey' derived from the hard-coded string '0penBmc' and a predictable 'bmcRandomNum'. This use of hard-coded credentials (CWE-798) and predictable randomness undermines the authentication mechanism, allowing potential unauthorized access. Multiple downstream vendors implement this IPMI stack, increasing the scope of impact.

The vulnerability allows unauthenticated attackers to bypass normal authentication by exploiting hard-coded credentials and predictable random numbers in the IPMI authentication process. This can lead to full compromise of the IPMI service, affecting confidentiality, integrity, and availability of the system. The CVSS 3.1 score of 8.1 reflects high impact with network attack vector, high complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, affected organizations should monitor vendor advisories and consider restricting network access to IPMI interfaces to trusted management networks.