CVE-2025-15679CWE-258

CVE-2025-15679

published September 11, 2026

CVSS
7.3
EPSS
0%
Percentile
1.3
In the wild
Unconfirmed
What it is

Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515.

The record
Technical detail
CVSS
7.3 · NONE
CVSS v4.0
7.3 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:P/S:P/AU:N/R:U/V:C/RE:L/U:Clear
EPSS
0.00111 · 1.3th percentile
Weakness
CWE-258 · Empty Password in Configuration File
Published
2026-09-11T13:17Z
References (1)
https://myatos.my.site.com/psmcustomer/s/contentdocument/069ci00000eNzLYAA0 · 5bcc34ac-0282-4e8a-96fc-046c583d3048
EPSS history
Timeline
  • 12 SEP 03:17Z
    EPSS moved — → 0%
    epss
  • 11 SEP 08:02Z
    BMC root account active without password
    cvelistv5