CVE-2025-15679: BullSequana XH3406/XH3515 Auth Bypass Flaw

CVE-2025-15679 Overview

CVE-2025-15679 affects the Baseboard Management Controller (BMC) on Eviden BullSequana XH3406 and XH3515 high-performance computing systems. Under specific conditions, including a reset-to-factory-default operation, the BMC root account becomes active without a password. An attacker with local access to the management interface can authenticate as root and gain full administrative control of the BMC. The weakness is tracked as CWE-258: Empty Password in Configuration File.

Critical Impact

A passwordless BMC root account grants complete out-of-band control of the server, including firmware, power state, and host operating system interactions.

Affected Products

• Eviden BullSequana XH3406 (BMC firmware)
• Eviden BullSequana XH3515 (BMC firmware)
• Systems restored to factory-default BMC configuration

Discovery Timeline

• 2026-09-11 - CVE-2025-15679 published to the National Vulnerability Database
• 2026-09-11 - Last updated in NVD database

Technical Details for CVE-2025-15679

Vulnerability Analysis

The BullSequana XH3406 and XH3515 are compute blades used in high-density HPC deployments. Their BMC provides out-of-band management functions such as power control, firmware update, sensor telemetry, and remote console access. On these platforms, certain state transitions, notably a reset-to-factory-default operation, activate the built-in root account while leaving its password field empty. Any actor who can reach the BMC management interface after such an event can log in as root without providing credentials.

Control of the BMC is equivalent to physical access to the server. An attacker can flash malicious firmware, alter boot configuration, mount virtual media, capture keystrokes through the remote KVM, and manipulate the host operating system independently of any endpoint controls running on the compute node.

Root Cause

The issue is a configuration flaw classified under CWE-258: the factory-default configuration leaves the root account enabled with no password set. Restoring defaults does not force credential re-initialization or lock the account until an administrator provisions a password.

Attack Vector

Exploitation requires local access to the BMC management network. An attacker who has connectivity to the BMC after a factory reset, whether through a dedicated management LAN, a shared NIC, or physical serial-over-LAN, can authenticate as root with an empty password. No user interaction is required, and the attack completes in a single authentication step.

No public proof-of-concept has been released. Refer to the vendor advisory for exploitation preconditions: MyAtos Customer Document.

Detection Methods for CVE-2025-15679

Indicators of Compromise

• BMC authentication events showing successful root logins without a corresponding password change history.
• Unexpected BMC firmware updates, virtual media mounts, or KVM sessions following a factory-reset event.
• Configuration drift on the BMC, such as new user accounts, SSH keys, or SNMP community strings appearing shortly after a reset.

Detection Strategies

• Audit BMC user databases across the fleet for accounts with empty password hashes.
• Correlate factory-reset operations with subsequent root authentications on the same management interface.
• Alert on BMC administrative actions originating from IP addresses outside the approved management subnet.

Monitoring Recommendations

• Forward BMC syslog and Redfish audit events to a centralized logging platform for retention and analysis.
• Baseline expected BMC firmware versions and configuration objects; alert on deviations.
• Track power-control and virtual-media operations as high-value events subject to review.

How to Mitigate CVE-2025-15679

Immediate Actions Required

• Inventory all BullSequana XH3406 and XH3515 systems and identify any that have recently undergone a factory-default reset.
• Set a strong password on the BMC root account immediately after any reset operation, before returning the system to service.
• Restrict BMC management interfaces to a dedicated, segmented network reachable only by authorized administrators.

Patch Information

Eviden distributes remediation details through customer support channels. Consult the vendor advisory at MyAtos Customer Document for firmware updates and configuration guidance applicable to XH3406 and XH3515 systems.

Workarounds

• Disable or lock the built-in root account after provisioning named administrative accounts with individual credentials.
• Enforce a post-reset provisioning workflow that requires setting a BMC password before the interface is exposed to the network.
• Place management interfaces behind a jump host and require multi-factor authentication for administrator access.
• Apply network access control lists on the management VLAN to permit only known administrator endpoints.