AMI MegaRAC SPx (IPMI handler): Timing and response differences in the IPMI handler let an unauthenticated attacker

CVSS 5.3CVE-2023-34344Firmware, BMC & network fabricAMI-SA-2023005NVIDIA OSR reviewcurated

Impact

Timing and response differences in the IPMI handler let an unauthenticated attacker confirm which usernames exist on the BMC. On its own it leaks nothing but names; in a fleet it is the reconnaissance step that makes credential-stuffing efficient, because it tells the attacker which nodes still carry the vendor default account or the provisioning template's service account before they spend any attempts.

Who can reach it

Network-reachable IPMI service, no credentials, no interaction. Any host that can reach UDP/623 on the BMC can enumerate accounts across the whole management range in a single sweep.

What to do

Firmware flash to SPx_12.7 / SPx_13.5, out-of-band per node, ODM-gated. Genuinely low urgency for the flash itself. The config-only work is what matters: remove or rename vendor default accounts, ensure no username is shared across the fleet by the provisioning template, and disable IPMI-over-LAN where your tooling allows it - that closes the enumeration surface outright with no reboot.

References

https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023005.pdf https://nvd.nist.gov/vuln/detail/CVE-2023-34344

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.