AMI MegaRAC SPx 12 / SPx 13 (BMC login): The login flow answers differently for real and fake usernames, so

CVSS 5.3CVE-2021-45925Firmware, BMC & network fabricAMI-SA-2022001Nozomi Labs BMC firmware researchcurated

Impact

The login flow answers differently for real and fake usernames, so an unauthenticated attacker can enumerate every valid BMC account. The value to an attacker is targeting: sweep the management range, learn which nodes still carry the ODM's default account or the provisioning template's service account, and aim credential-stuffing only at those. It turns a noisy brute-force into a quiet, low-attempt campaign that will not trip lockout thresholds.

Who can reach it

Unauthenticated network access to the BMC web login. Anything that can reach the BMC's HTTP/HTTPS port on the management VLAN.

What to do

Firmware flash to SPx_12-update-7.00 / SPx_13-update-5.00 or later; low urgency on its own, fold it into whatever BMC flash campaign you are already running. The config-only work carries most of the value and costs nothing: delete vendor default accounts, avoid a fleet-wide shared username in the provisioning template, and enable BMC account lockout plus authentication logging to your SIEM so the enumeration sweep itself becomes visible.

References

https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2022001.pdf https://www.nozominetworks.com/labs/vulnerability-advisories/cve-2021-45925/https://nvd.nist.gov/vuln/detail/CVE-2021-45925

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.