AMI MegaRAC SPx (IPMI handler): Timing and response differences in the IPMI handler let an unauthenticated attacker

Impact

Timing and response differences in the IPMI handler let an unauthenticated attacker confirm which usernames exist on the BMC. On its own it leaks nothing but names; in a fleet it is the reconnaissance step that makes credential-stuffing efficient, because it tells the attacker which nodes still carry the vendor default account or the provisioning template's service account before they spend any attempts.

Who can reach it

Network-reachable IPMI service, no credentials, no interaction. Any host that can reach UDP/623 on the BMC can enumerate accounts across the whole management range in a single sweep.

What to do

Firmware flash to SPx_12.7 / SPx_13.5, out-of-band per node, ODM-gated. Genuinely low urgency for the flash itself. The config-only work is what matters: remove or rename vendor default accounts, ensure no username is shared across the fleet by the provisioning template, and disable IPMI-over-LAN where your tooling allows it - that closes the enumeration surface outright with no reboot.

References