Database/Firmware, BMC & network fabric
Lenovo XCC3 BMC: Reset to Default restores the default OpenBMC root password
Impact
On the affected XCC3 builds, a Reset to Default brings back the default OpenBMC root credential. Anyone who knows that credential gets administrative access to the BMC's enabled interfaces, and also gets the underlying XCC operating system, which is normally not accessible. BMC control means power control, console and virtual media on the GPU server, and a foothold below the host OS that a host reimage does not remove. The risk is concentrated on fleets that use Reset to Default during provisioning or RMA.
Who can reach it
Anyone who can reach the XCC management interfaces, typically on the management VLAN, after a Reset to Default has been run on an affected version. They log in with the publicly known default credential, so no other secret is needed.
What to do
Lenovo has withdrawn the affected versions (2.51 IHX432Y to 2.56 IHX436K). Update XCC3 to a later release according to the Lenovo advisory. A BMC firmware flash is usually done without taking the host out of service, but follow your normal BMC update process. On any controller that ran Reset to Default on an affected version, rotate the root credential and treat the BMC as possibly accessed. Keep XCC interfaces restricted to the management network.
References
Related entries
- Dell OpenManage Enterprise: unauthenticated adjacent attacker steals a console sessionCVE-2026-91914 · Dell OpenManage Enterprise (authentication bypass by spoofing / session theft)High
- IBM Server Firmware: unauthenticated request crashes the ASMI management web serverCVE-2026-93306 · IBM Server Firmware (ASMI web interface)High
- HPE iLO 4 / iLO 5 (remote buffer overflow): Remotely triggerable buffer overflow in the iLO firmware on both the Gen9CVE-2019-11983 · HPE iLO 4 / iLO 5 (remote buffer overflow)High
- Insyde InsydeH2O (PnpSmm shared SMM/non-SMM buffer, DMA TOCTOU): A buffer shared between SMM and non-SMM codeCVE-2022-32469 · Insyde InsydeH2O (PnpSmm shared SMM/non-SMM buffer, DMA TOCTOU)High
- Insyde InsydeH2O (FwBlockServiceSmm shared buffer, DMA TOCTOU): The firmware block service's shared buffer is racy, soCVE-2022-32470 · Insyde InsydeH2O (FwBlockServiceSmm shared buffer, DMA TOCTOU)High
- Insyde InsydeH2O (IhisiSmm / IhisiDxe command buffer): One representative of a family of roughly a dozen InsydeCVE-2022-32471 · Insyde InsydeH2O (IhisiSmm / IhisiDxe command buffer)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.