Supermicro BMC Hardcoded RAKP Key

Executive summary #

Supermicro BMCs ship with an optional "SMCRAKP" mode intended to prevent the standard IPMI RAKP-2 password-hash disclosure. When an administrator enables it, the RMCP+/RAKP handler substitutes a fixed 20-byte constant for the target account's password when computing the RAKP key-exchange authentication code. A network client that knows the constant can complete the handshake for any enabled account without that account's password. This vulnerability has an estimated CVSSv3.1 score of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5, High), and is an instance of CWE-798 (Use of Hard-coded Credentials).

Technical details #

The constant fab979d849be933dd0c41fd2c9d77a30aa8d3f50 is present with no relocation in both the ATEN libipmi.so (X10 through X13, H13) and the OpenBMC netipmid build shipped on X14, recoverable from the public firmware. On X14, the RAKP1/2 handler zeroes the session's 20-byte userKey field and then branches on the EnableSMCRAKP D-Bus property: when the property is set, it copies the constant into userKey; otherwise it copies the account's real password. The RAKP2 authentication code is generated as HMAC(userKey, transcript), so with SMCRAKP enabled the code the BMC sends is HMAC(constant, transcript) rather than HMAC(password, transcript).

To reproduce, enable SMCRAKP, open an RMCP+ session for an enabled administrator account, and compute the RAKP Message 3 authentication code with the fixed key. On an ATEN-based unit, send the subsequent command with the authenticated and encrypted header bits clear. A representative X13 result is:

RAKP-2 HMAC key match: fab979d849be933dd0c41fd2c9d77a30aa8d3f50 (SMC-RAKP-OEM-KEY)
RAKP Message 4 status=0x00 (session active)
cleartext Get Device ID: completion_code=0x00
data=2001010702bf7c2a00000001020000

The fixed key completes authentication, and the separate missing-protection defect in the receive path permits commands without the password-derived packet keys. X14 activates the handshake but rejects those unprotected commands.

Attacker value #

This issue can allow an unauthenticated attacker to gain administrative access to the IPMI service on ATEN-based systems where SMCRAKP is enabled. The attacker needs the username of an enabled account but not its password. Administrative IPMI access includes power and boot control, sensor and FRU access, user administration, serial-over-LAN, and affected OEM command paths.

On X14, the forged handshake cannot issue commands because netipmid enforces the negotiated integrity and encryption algorithms. The resulting RAKP Message 4 still provides a password-derived offline verification value.

Note that is is not a default configuration. The mode is off by default and exposure is limited to systems where this mode was explicitly enabled.

If this configuration is enabled, this issue could be chained with CVE-2026-65210 or CVE-2026-65211 to significantly extend Administrative IPMI access to total compromise of the affected device.

Credit #

This issue was discovered by HD Moore with the help of AI tools. Disclosure was coordinated by Tod Beardsley.