IBM OpenBMC OP920 / OP930 / OP940: An unauthenticated caller retrieves sensitive information from the BMC

Impact

An unauthenticated caller retrieves sensitive information from the BMC. Same operational shape as the 2024 bmcweb URI disclosure three years earlier and on the same product line, which is the useful signal: pre-auth information exposure on this BMC stack is recurring, not a one-off. For a fleet operator the leaked material is inventory and configuration detail that lets an attacker pick which nodes to attack and with what.

Who can reach it

Unauthenticated network access to the BMC's management interface.

What to do

Fixed in later OP920/OP930/OP940 firmware - a per-node system firmware update requiring a maintenance window. Because this class keeps recurring on the same stack, the durable control is the network boundary: BMCs on an isolated management VLAN reachable only from bastion hosts, so pre-auth disclosure bugs have no audience. That is config-only and it covers the next one too.

References