Older BMCs and legacy factory configurations often use fixed default credentials, and those credentials may persist because the management controller is treated as isolated infrastructure. Defaults vary by vendor, product generation, and ordering option. Dell's legacy iDRAC configuration uses root/calvin, but current PowerEdge systems normally ship with a unique generated password unless the legacy option was selected. Other vendors likewise use either model-specific fixed defaults or per-device credentials printed on a label. Successful authentication with an unchanged administrative default can grant control of host power, physical console, and virtual media.
# identify the vendor and generation, then test its documented default policy
ipmitool -I lanplus -H <bmc> -U root -P calvin user list # legacy-configured Dell iDRAC
ipmitool -I lanplus -H <bmc> -U ADMIN -P ADMIN user list # common Supermicro default
curl -sk https://<bmc>/ | grep -iE 'idrac|ilo|supermicro' # fingerprint for the web UI
Exploitation notes#
- Fingerprint the vendor and generation first, then consult that product's documented factory policy. Treat
root/calvinas a Dell legacy option rather than a universal current default. - The BMC being on a "private" management network is why defaults persist; once you reach that network (a flat segment, a jump host, a VLAN hop), defaults are the easiest path.
- Default admin access yields power control, KVM console, and virtual media, enough to boot an attacker image and own the OS, see iDRAC and iLO.
- Combine with RAKP hash disclosure (which often recovers exactly these default passwords) and cipher 0 where defaults were changed.