AMI MegaRAC SPx (BMC hard-coded credentials): Hard-coded credentials inside the BMC firmware

Impact

Hard-coded credentials inside the BMC firmware. Once extracted from a publicly downloadable image, they work on every BMC running that build regardless of what passwords the operator set, so your entire fleet shares an authentication backdoor you cannot rotate. That converts a per-node authentication story into a single fleet-wide key, and BMC access means power control, console, virtual media and firmware.

Who can reach it

Adjacent network reachability to the BMC plus a valid user session and some interaction, per AMI's vector. The credential itself is obtained offline by unpacking a firmware image - no access to your systems is needed for that half.

What to do

Firmware flash to SPx_12.2 / SPx_13.0 or later. This one has been fixed since early SPx builds, so the operator task is an audit: enumerate the actual running BMC firmware version across the fleet and find the SKUs still on a pre-fix ODM image - typically older or white-box nodes whose vendor stopped publishing BMC updates. There is no config-only fix, because the credential is baked into the image; the only compensating control is hard network isolation of the BMC plane so the credential has nothing to authenticate against.

References