IBM OpenBMC default password and session management (FW1020, FW1030, FW1050): The combination of a shipped default

Impact

The combination of a shipped default password and how sessions are managed lets an attacker reach BMC administrator. Full administrative control of the BMC means power state, virtual media, console, firmware update - i.e. the ability to install a persistent implant and to reimage or brick nodes. Default-credential findings are unglamorous and they are also how BMC fleets actually get owned: an operator who racked 400 nodes and changed the OS credentials but not the BMC's is the modal case.

Who can reach it

Network access to the BMC plus, per the CVSS vector, some user interaction and higher attack complexity. Practically: an attacker on the management network against a BMC whose default credential was never rotated or where a stale session can be reused.

What to do

Fixed in IBM firmware past FW1050.10 / FW1030.50 / FW1020.60 - a per-node system firmware update with a maintenance window. The action that matters more and costs nothing: audit every BMC in the fleet for the vendor default credential right now, rotate to per-node unique passwords, and make credential rotation part of node provisioning rather than a one-time sweep. On a rented bare-metal fleet, also rotate BMC credentials between tenants.

References

Related entries

• Supermicro BIOS (arbitrary memory write, X11DPH series): Arbitrary memory write from firmware context on X11DPH boardsCVE-2024-36433 · Supermicro BIOS (arbitrary memory write, X11DPH series)High
• Supermicro BIOS SMM callout (X11DPH-T / X11DPH-Tq): Execution in System Management Mode, the most privileged executionCVE-2024-36434 · Supermicro BIOS SMM callout (X11DPH-T / X11DPH-Tq)High
• Dell SmartFabric OS10 (uncontrolled resource consumption): A remote unauthenticated host can exhaust resources on anCVE-2024-37125 · Dell SmartFabric OS10 (uncontrolled resource consumption)High
• Sunbird DCIM dcTrack v9.1.2 - ticket location RBAC: Incorrect access control lets an attacker create or update ticketsCVE-2024-37775 · Sunbird DCIM dcTrack v9.1.2 - ticket location RBACHigh
• Dell SmartFabric OS10 (command injection): Command injection in SmartFabric OS10 10.5.5.4-10.5.5.10 and 10.5.6.xCVE-2024-38486 · Dell SmartFabric OS10 (command injection)High
• Linux kernel - RDMA/rxe unreliable datagram responder, drivers/infiniband/sw/rxe/rxe_resp.c: The IB architecture says aCVE-2024-40992 · Linux kernel - RDMA/rxe unreliable datagram responder, drivers/infiniband/sw/rxe/rxe_resp.cHigh