Supermicro IPMI BMC firmware (WPCM450 / X8-X9 generation): An unauthenticated HTTP GET for /PSBlock on port 49152

Impact

An unauthenticated HTTP GET for /PSBlock on port 49152 returns the BMC's user database with passwords in cleartext. No exploit and no authentication are involved - it is a file read. Those credentials are usually reused across the whole fleet and often match the IPMI accounts on every other chassis the operator bought at the same time, so one exposed node yields the management plane for all of them: power control, virtual media boot of an attacker image, and KVM to the console. No CVE was ever assigned to this, so it appears in no NVD-derived feed and no scanner keyed on CVE identifiers.

Who can reach it

Anyone who can reach TCP/49152 on the BMC. At disclosure roughly 32,000 hosts were reachable directly from the internet; inside a datacenter, any tenant with a route to the management VLAN qualifies.

What to do

Update BMC firmware to the fixed generation from Supermicro, then rotate every IPMI credential - the old ones must be assumed public, and a firmware update does not invalidate them. Verify port 49152 is closed after the update rather than trusting the release notes. Put the management network behind its own VLAN with no tenant route, and confirm that from a tenant workload rather than from a jump host. Nodes too old to receive fixed firmware should be treated as permanently exposed and segmented accordingly.

References

Related entries

• Dell iDRAC9 (Virtual Console / authentication): An attacker with no credentials lands directly inside the server'sCVE-2021-21538 · Dell iDRAC9 (Virtual Console / authentication)Critical
• Dell iDRAC9 (VNC server): Unauthenticated access to the iDRAC VNC consoleCVE-2022-24422 · Dell iDRAC9 (VNC server)Critical
• AMI MegaRAC SPx 12 / SPx 13 (BMC network service): The twin of CVE-2023-37293: a stack smash in the BMC'sCVE-2023-3043 · AMI MegaRAC SPx 12 / SPx 13 (BMC network service)Critical
• AMI MegaRAC SPx 12 / SPx 13 (BMC network service): Unauthenticated code execution inside the BMC, reachedCVE-2023-37293 · AMI MegaRAC SPx 12 / SPx 13 (BMC network service)Critical
• Arista EOS (OpenConfig gNMI Set authorization): A gNMI Set request that authorization should have rejected is executedCVE-2024-27892 · Arista EOS (OpenConfig gNMI Set authorization)Critical
• IBM Power FSP: malformed ASMI request gives unauthenticated code execution on the service processorCVE-2026-16687 · IBM Power Systems Firmware (FSP service processor, ASMI web interface)Critical