AMI MegaRAC SPx 12 / SPx 13 (BMC login): The login flow answers differently for real and fake usernames, so

Impact

The login flow answers differently for real and fake usernames, so an unauthenticated attacker can enumerate every valid BMC account. The value to an attacker is targeting: sweep the management range, learn which nodes still carry the ODM's default account or the provisioning template's service account, and aim credential-stuffing only at those. It turns a noisy brute-force into a quiet, low-attempt campaign that will not trip lockout thresholds.

Who can reach it

Unauthenticated network access to the BMC web login. Anything that can reach the BMC's HTTP/HTTPS port on the management VLAN.

What to do

Firmware flash to SPx_12-update-7.00 / SPx_13-update-5.00 or later; low urgency on its own, fold it into whatever BMC flash campaign you are already running. The config-only work carries most of the value and costs nothing: delete vendor default accounts, avoid a fleet-wide shared username in the provisioning template, and enable BMC account lockout plus authentication logging to your SIEM so the enumeration sweep itself becomes visible.

References