IBM OpenPower firmware OP910/OP920 - OpenBMC IPMI credential handling: The original default BMC password kept working

CVSS 9.1CVE-2019-4169Firmware, BMC & network fabricIBM X-Force 158702curated

Impact

The original default BMC password kept working over IPMI after an operator changed it. Every hardening runbook says 'change the default BMC password' and on these firmware levels doing so accomplished nothing for the IPMI path - the fleet stayed openable with a credential printed in the vendor documentation. This is the cleanest example in the cluster of why BMC posture cannot be assessed from configuration intent: you have to test that the old credential is actually dead.

Who can reach it

Network access to the BMC's IPMI interface with the publicly documented default credential. No prior foothold required.

What to do

Fixed in later OpenPower firmware; delivery is a per-node system firmware update with a maintenance window. The transferable lesson is a test, not a patch: after any BMC credential rotation, actively attempt an IPMI and Redfish login with the old and default credentials and alert if either succeeds. Make that a recurring fleet check, not a one-off - it catches this class of bug on any vendor.

References

https://nvd.nist.gov/vuln/detail/CVE-2019-4169 https://exchange.xforce.ibmcloud.com/vulnerabilities/158702

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.