AMI MegaRAC: Default credentials — Redfish API accessible with shipped account

CVE-2022-40259Firmware, BMC & network fabriccurated

Impact

Default credentials — Redfish API accessible with shipped account; full BMC control

Who can reach it

Network / Redfish API

What to do

Credential rotation at rack intake; treat any node received from an ODM as compromised-by-default until BMC accounts are reset

References

https://nvd.nist.gov/vuln/detail/CVE-2022-40259

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.