IBM OpenBMC default password and session management (FW1020, FW1030, FW1050): The combination of a shipped default

Impact

The combination of a shipped default password and how sessions are managed lets an attacker reach BMC administrator. Full administrative control of the BMC means power state, virtual media, console, firmware update - i.e. the ability to install a persistent implant and to reimage or brick nodes. Default-credential findings are unglamorous and they are also how BMC fleets actually get owned: an operator who racked 400 nodes and changed the OS credentials but not the BMC's is the modal case.

Who can reach it

Network access to the BMC plus, per the CVSS vector, some user interaction and higher attack complexity. Practically: an attacker on the management network against a BMC whose default credential was never rotated or where a stale session can be reused.

What to do

Fixed in IBM firmware past FW1050.10 / FW1030.50 / FW1020.60 - a per-node system firmware update with a maintenance window. The action that matters more and costs nothing: audit every BMC in the fleet for the vendor default credential right now, rotate to per-node unique passwords, and make credential rotation part of node provisioning rather than a one-time sweep. On a rented bare-metal fleet, also rotate BMC credentials between tenants.

References