Lenovo Warns of High-Severity Server Flaw That Restores Default Root Credentials After Reset

A development regression in Lenovo's ThinkSystem V4 XClarity Controller 3 firmware caused factory resets to silently restore a known default root password for the OpenBMC management interface, effectively undoing any credential hardening administrators had applied. This is especially dangerous because factory resets are often performed during troubleshooting or hardware redeployment — moments when security posture is already in flux. An attacker with network access to the BMC interface could exploit the restored default credentials to gain full administrative control over the server's out-of-band management system. The incident underscores that secure-by-default configuration must be rigorously validated across the entire firmware lifecycle, including reset and recovery paths, not just initial provisioning.