Search
Find a vulnerability
Search criteria
2 vulnerabilities found for BullSequana XH3406 by Bull
CVE-2025-15679 (GCVE-0-2025-15679)
Vulnerability from nvd – Published: 2026-09-11 08:02 – Updated: 2026-09-11 15:25
VLAI
EPSS
VEX
Title
BMC root account active without password on BullSequana XH3406 and XH3515
Summary
Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 15:23 UTC
CWE
- CWE-258 - Empty password in configuration file
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://myatos.my.site.com/psmcustomer/s/contentd… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Bull | BullSequana XH3406 |
Affected:
0 , < TS 04.05
(custom)
|
|
| Bull | BullSequana XH3515 |
Affected:
0 , < TS 43.01
(custom)
|
Date Public
2026-09-11 08:01
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-15679",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T15:23:45.592824Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T15:25:17.549Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "BullSequana XH3406",
"vendor": "Bull",
"versions": [
{
"lessThan": "TS 04.05",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "BullSequana XH3515",
"vendor": "Bull",
"versions": [
{
"lessThan": "TS 43.01",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Reset to factory default operation."
}
],
"value": "Reset to factory default operation."
}
],
"datePublic": "2026-09-11T08:01:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515."
}
],
"value": "Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515."
}
],
"impacts": [
{
"capecId": "CAPEC-70",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-70 Try Common or Default Usernames and Passwords"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "NONE",
"providerUrgency": "CLEAR",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:P/S:P/AU:N/R:U/V:C/RE:L/U:Clear",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-258",
"description": "CWE-258 Empty password in configuration file",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T13:15:43.199Z",
"orgId": "5bcc34ac-0282-4e8a-96fc-046c583d3048",
"shortName": "Bull"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://myatos.my.site.com/psmcustomer/s/contentdocument/069ci00000eNzLYAA0"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003eApply one of the fixed Technical state mentionned above.\u003cdiv\u003e\u003cdiv\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "Apply one of the fixed Technical state mentionned above."
}
],
"source": {
"advisory": "PSIRT-2066",
"discovery": "INTERNAL"
},
"title": "BMC root account active without password on BullSequana XH3406 and XH3515",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "5bcc34ac-0282-4e8a-96fc-046c583d3048",
"assignerShortName": "Bull",
"cveId": "CVE-2025-15679",
"datePublished": "2026-09-11T08:02:03.465Z",
"dateReserved": "2026-08-04T11:26:59.448Z",
"dateUpdated": "2026-09-11T15:25:17.549Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-15679 (GCVE-0-2025-15679)
Vulnerability from cvelistv5 – Published: 2026-09-11 08:02 – Updated: 2026-09-11 15:25
VLAI
EPSS
VEX
Title
BMC root account active without password on BullSequana XH3406 and XH3515
Summary
Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-11 15:23 UTC
CWE
- CWE-258 - Empty password in configuration file
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://myatos.my.site.com/psmcustomer/s/contentd… | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Bull | BullSequana XH3406 |
Affected:
0 , < TS 04.05
(custom)
|
|
| Bull | BullSequana XH3515 |
Affected:
0 , < TS 43.01
(custom)
|
Date Public
2026-09-11 08:01
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-15679",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T15:23:45.592824Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T15:25:17.549Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "BullSequana XH3406",
"vendor": "Bull",
"versions": [
{
"lessThan": "TS 04.05",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "BullSequana XH3515",
"vendor": "Bull",
"versions": [
{
"lessThan": "TS 43.01",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Reset to factory default operation."
}
],
"value": "Reset to factory default operation."
}
],
"datePublic": "2026-09-11T08:01:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515."
}
],
"value": "Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515."
}
],
"impacts": [
{
"capecId": "CAPEC-70",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-70 Try Common or Default Usernames and Passwords"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NO",
"Recovery": "USER",
"Safety": "PRESENT",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "NONE",
"providerUrgency": "CLEAR",
"subAvailabilityImpact": "LOW",
"subConfidentialityImpact": "LOW",
"subIntegrityImpact": "LOW",
"userInteraction": "NONE",
"valueDensity": "CONCENTRATED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:P/S:P/AU:N/R:U/V:C/RE:L/U:Clear",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "LOW"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-258",
"description": "CWE-258 Empty password in configuration file",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T13:15:43.199Z",
"orgId": "5bcc34ac-0282-4e8a-96fc-046c583d3048",
"shortName": "Bull"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://myatos.my.site.com/psmcustomer/s/contentdocument/069ci00000eNzLYAA0"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cdiv\u003e\u003cdiv\u003eApply one of the fixed Technical state mentionned above.\u003cdiv\u003e\u003cdiv\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003c/div\u003e\u003cbr\u003e"
}
],
"value": "Apply one of the fixed Technical state mentionned above."
}
],
"source": {
"advisory": "PSIRT-2066",
"discovery": "INTERNAL"
},
"title": "BMC root account active without password on BullSequana XH3406 and XH3515",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "5bcc34ac-0282-4e8a-96fc-046c583d3048",
"assignerShortName": "Bull",
"cveId": "CVE-2025-15679",
"datePublished": "2026-09-11T08:02:03.465Z",
"dateReserved": "2026-08-04T11:26:59.448Z",
"dateUpdated": "2026-09-11T15:25:17.549Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}