Factory Reset Restores Default Root Credentials in Lenovo Server Firmware
Written by AI from the linked story. Not reviewed by an editor. How this works
A development regression in Lenovo's ThinkSystem V4 XClarity Controller 3 firmware caused factory resets to silently restore a known default root password for the OpenBMC management interface, effectively undoing any credential hardening administrators had applied. This is especially dangerous because factory resets are often performed during troubleshooting or hardware redeployment — moments when security posture is already in flux. An attacker with network access to the BMC interface could exploit the restored default credentials to gain full administrative control over the server's out-of-band management system. The incident underscores that secure-by-default configuration must be rigorously validated across the entire firmware lifecycle, including reset and recovery paths, not just initial provisioning.
Tactical Insight
Immediate actions
- Apply Lenovo's patched XClarity Controller 3 firmware to all affected ThinkSystem V4 servers immediately.
- Audit BMC/iDRAC/iLO management interfaces for any systems that have undergone a factory reset and verify root credentials are not set to defaults.
- Isolate out-of-band management interfaces on a dedicated, access-controlled management VLAN until patching is confirmed.
Long-term improvements
- Establish a policy requiring credential verification and re-hardening as a mandatory step in any factory reset or hardware redeployment procedure.
- Integrate firmware vulnerability tracking into your vulnerability management program, including vendor advisories for server management controllers.
- Require vendors to provide firmware release notes that explicitly document the security impact of reset and recovery operations.
Detection measures
- Deploy automated configuration compliance scanning to detect default or weak credentials on management interfaces after any reset event.
- Enable alerting on successful BMC logins using default usernames so anomalous access is flagged immediately.