BullSequana XH3406: Empty Password in Configuration File
CVE-2025-15679 is a high-severity empty password in configuration file vulnerability in BullSequana XH3406 from Bull, with a CVSS 4.0 base score of 7.3 out of 10. It can be exploited with local access to the system by an unauthenticated attacker, without any action from a user. The record lists version TS 04.05 as the first without the flaw, so updating BullSequana XH3406 to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.16% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update BullSequana XH3406 to TS 04.05 or a later version.
- Update BullSequana XH3515 to TS 43.01 or a later version.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Bull | BullSequana XH3406 | before TS 04.05 | TS 04.05 |
| Bull | BullSequana XH3515 | before TS 43.01 | TS 43.01 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Attack requirements
- NoneThe attack does not depend on a particular deployment or configuration.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Confidentiality (vulnerable system)
- HighSerious loss of confidentiality on the vulnerable system.
- Integrity (vulnerable system)
- HighSerious loss of integrity on the vulnerable system.
- Availability (vulnerable system)
- HighSerious loss of availability on the vulnerable system.
- Confidentiality (other systems)
- LowLimited loss of confidentiality on systems beyond the vulnerable one.
- Integrity (other systems)
- LowLimited loss of integrity on systems beyond the vulnerable one.
- Availability (other systems)
- LowLimited loss of availability on systems beyond the vulnerable one.
Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:N/R:U/V:C/RE:L/U:Clear. Scored by CNA.
Official description
Under certain circumstances such as reset to factory default operation, the BMC root account is made active without a password on BullSequana XH3406 and XH3515.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Empty Password in Configuration File
Using an empty string as a password is insecure.
More Empty Password in Configuration File vulnerabilities (CWE-258)
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Recent Empty Password in Configuration File vulnerabilities
- 9.8 Critical severity
- 8.8 High severity
- 9.8 Critical severity
Spotted an error? Tell us.