[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fjGuDntf6EI3T4RwktBIQS1AKuvxYfcitPwo0QpFVAJ8":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":17,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":43,"controls":44},"377fa3ad-9c25-4da7-b6b8-603e4f8d50bc","factory-reset-restores-default-root-credentials-in-lenovo-server-firmware","8b41a31b-af03-482b-a25e-847f080b9662","Factory Reset Restores Default Root Credentials in Lenovo Server Firmware","A development regression in Lenovo's ThinkSystem V4 XClarity Controller 3 firmware caused factory resets to silently restore a known default root password for the OpenBMC management interface, effectively undoing any credential hardening administrators had applied. This is especially dangerous because factory resets are often performed during troubleshooting or hardware redeployment — moments when security posture is already in flux. An attacker with network access to the BMC interface could exploit the restored default credentials to gain full administrative control over the server's out-of-band management system. The incident underscores that secure-by-default configuration must be rigorously validated across the entire firmware lifecycle, including reset and recovery paths, not just initial provisioning.","**Immediate actions:**\n- Apply Lenovo's patched XClarity Controller 3 firmware to all affected ThinkSystem V4 servers immediately.\n- Audit BMC\u002FiDRAC\u002FiLO management interfaces for any systems that have undergone a factory reset and verify root credentials are not set to defaults.\n- Isolate out-of-band management interfaces on a dedicated, access-controlled management VLAN until patching is confirmed.\n\n**Long-term improvements:**\n- Establish a policy requiring credential verification and re-hardening as a mandatory step in any factory reset or hardware redeployment procedure.\n- Integrate firmware vulnerability tracking into your vulnerability management program, including vendor advisories for server management controllers.\n- Require vendors to provide firmware release notes that explicitly document the security impact of reset and recovery operations.\n\n**Detection measures:**\n- Deploy automated configuration compliance scanning to detect default or weak credentials on management interfaces after any reset event.\n- Enable alerting on successful BMC logins using default usernames so anomalous access is flagged immediately.",[12,13,14,15,16],"CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-53 IA-5: Authenticator Management","NIS2 Article 21(2)(e)","NIST CSF 2.0 PR.AA-01: Identity management, authentication, and access control",{"NIS2 Article 21(2)(e)":18,"NIST SP 800-53 CM-6: Configuration Settings":19,"NIST SP 800-53 IA-5: Authenticator Management":20,"CIS Control 4: Secure Configuration of Enterprise Assets and Software (v8)":21,"NIST CSF 2.0 PR.AA-01: Identity management, authentication, and access control":22},"This point covers security in acquisition, development and maintenance including vulnerability handling — the regression introduced during development and the need for secure coding and testing practices in firmware directly reflects this requirement.","CM-6 requires that security configuration settings be established and enforced, including ensuring that resets or recovery operations do not revert systems to insecure default states.","IA-5 governs the lifecycle management of authenticators and explicitly prohibits the use of default passwords, which this firmware regression re-introduced upon factory reset.","CIS Control 4 requires that default credentials be changed and secure configurations be maintained — this incident shows a reset silently reverting to insecure defaults, violating that principle.","This category requires that credentials and authentication mechanisms be managed securely throughout the system lifecycle, which a reset-induced credential reversion directly undermines.","published","2026-11-12T14:22:14.77676+00:00","2026-11-12T14:22:14.756+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fcybersecuritynews.com\u002Flenovo-server-flaw\u002F","lenovo-warns-of-high-severity-server-flaw-that-restores-default-root-credentials-02bd0c","Lenovo Warns of High-Severity Server Flaw That Restores Default Root Credentials After Reset",[31,37],{"id":32,"name":33,"slug":34,"description":35,"color":36},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[45,49,52],{"slug":46,"name":47,"problem":48},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":40,"name":50,"problem":51},"Automated patch management","Known holes get closed in days, not months.",{"slug":53,"name":54,"problem":55},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date."]