Supermicro IPMI BMC firmware - hardcoded WSMAN credentials (X9 before SMT_X9_315, X8 before SMT X8 312): The BMC

Impact

The BMC firmware ships with a static WSMAN credential pair that is identical on every board of that generation and cannot be changed by the operator. Recover it once - from a firmware image anyone can download - and you hold a working management login on every affected BMC in the world, including every one in your competitors' racks and every one in yours. Rotating your BMC passwords does nothing: one of the credential sets is a digest-auth account with an immutable password, and the other is a basic-auth account that simply fails to follow the admin password when you change it. For an operator this breaks the assumption underneath all BMC access control, which is that credentials are something you own.

Who can reach it

Network, pre-auth in effect - the credential is public knowledge, so possession of it is not a privilege the attacker had to earn. Any reachability to the BMC management interface is sufficient.

What to do

Firmware flash to SMT_X9_315 / SMT X8 312 or later; there is no configuration change that removes a hardcoded credential. Until then treat every affected BMC as having a permanent open account and rely entirely on network isolation - management VLAN, no tenant routability, jump-host-only access - because per-device credential hygiene provides zero protection here. This is also the item to check first when acquiring second-hand or colocated hardware, since the previous operator's firmware level is now your exposure.

References