BMC Root Account Activation Without Password

Executive Summary

This vulnerability allows the BMC root account to become active without a password during certain operations, such as a factory reset. This means an attacker could gain full administrative access to the system without authentication.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking if the BMC root account is active without a password after a factory reset. Inspect BMC logs for reset events and verify root account status. No specific commands are provided in the available resources.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to take complete control of the system, install malware, steal sensitive data, or disrupt operations. It poses a high risk to system integrity and confidentiality.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Non-compliance may result in legal penalties and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Reset the BMC to factory defaults and ensure the root account is immediately assigned a strong password. Verify the BMC configuration to confirm the root account is disabled after reset unless explicitly required.

Useful 0 Not Useful 0