PatchSiren

PatchSiren cyber security CVE debrief

CVE-2025-15679 Bull CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-09-11T09:17:20.067Z and has not been modified since then. The BMC root account is made active without a password under certain circumstances, such as reset to factory default operation. This vulnerability affects defenders and administrators responsible for BMC configurations and security. They should assess exposure and prioritize verification to prevent unauthorized access and potential exploitation.

Vendor
Bull
Product
BullSequana XH3406
CVSS
HIGH 7.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-09-11
Original CVE updated
2026-09-11
Advisory published
2026-09-11
Advisory updated
2026-09-11

Who should care

Defenders and administrators responsible for BMC configurations and security should assess exposure and prioritize verification to prevent unauthorized access and potential exploitation. They should review compensating controls for exposed systems while remediation is scheduled and verified. This includes verifying BMC configurations for factory default operations and monitoring for unauthorized access attempts to A

Why it matters

Defenders should assess exposure and prioritize verification of BMC configurations, especially for factory default operations, to prevent unauthorized access and potential exploitation.

  • Verify BMC configurations for factory default operations to prevent unauthorized access
  • Assess exposure and prioritize remediation to minimize potential impact
  • Monitor for unauthorized access attempts to detect potential exploitation

Technical summary

The CVE record indicates that under certain circumstances, such as reset to factory default operation, the BMC root account is made active without a password. This vulnerability affects BMC configurations and security, allowing defenders to assess exposure and prioritize verification to prevent unauthorized access and potential exploitation. The CVE record provides official guidance on affected scope, severity, and vendor guidance.

Defensive priority

Defenders should assess exposure and prioritize verification of BMC configurations, especially for factory default operations.

Recommended defensive actions

  • Verify BMC configurations for factory default operations
  • Assess exposure and prioritize remediation
  • Monitor for unauthorized access attempts

Evidence notes

The CVE record indicates that under certain circumstances, such as reset to factory default operation, the BMC root account is made active without a password.

Sources and references

Verified primary and authoritative sources

  • CVE-2025-15679 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2025-15679

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2025-15679 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2025-15679

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://myatos.my.site.com/psmcustomer/s/contentdocument/069ci00000eNzLYAA0

    5bcc34ac-0282-4e8a-96fc-046c583d3048

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.