Bullsequana Xh3406
Monthly
BMC root account activation without a password on Bull BullSequana XH3406 and XH3515 HPC servers enables full out-of-band management compromise following a factory reset or equivalent triggering operation. With a PoC available (CVSS 4.0 E:P) and no privileges required once the vulnerable state exists, an attacker with access to the BMC management interface can achieve complete control over the managed server, including power cycling, firmware manipulation, and console access. No active exploitation is confirmed in CISA KEV at time of analysis.
BMC root account activation without a password on Bull BullSequana XH3406 and XH3515 HPC servers enables full out-of-band management compromise following a factory reset or equivalent triggering operation. With a PoC available (CVSS 4.0 E:P) and no privileges required once the vulnerable state exists, an attacker with access to the BMC management interface can achieve complete control over the managed server, including power cycling, firmware manipulation, and console access. No active exploitation is confirmed in CISA KEV at time of analysis.