Fujitsu / Fsas Technologies iRMC S6 BMC (M5-generation servers): A length-boundary bug in BMC authentication

Impact

A length-boundary bug in BMC authentication - a username of exactly the wrong length gets handled incorrectly and access control does not apply as intended. What the operator loses is the guarantee that their Redfish and web management surface enforces the roles they configured. This is worth carrying in a GPU-fleet database less for Fujitsu's market share than for the pattern: BMC authentication logic keeps failing on boundary conditions in string handling, and operators who assume Redfish role enforcement is sound are relying on code with a long history of exactly this class of defect. Servers before firmware 1.37S - Redfish and web UI access control mishandles the case where a username is exactly 16 characters long.

Who can reach it

Network reachability to the iRMC's Redfish or web interface. Exploitation depends on the username in play hitting the 16-character boundary, which an attacker can arrange when they control account creation or can guess an existing account name of that length.

What to do

Firmware flash of the iRMC to 1.37S or later - a per-node out-of-band BMC update. A config-only interim step that genuinely helps: audit BMC account names and eliminate any that are exactly 16 characters, which removes the triggering condition without waiting for a flash window. Fujitsu's PSIRT publishes a readable PDF advisory, which puts them ahead of most of the ODM vendors in this database on advisory accessibility.

References