Failing to change default credentials on BMCs is one of the most critical vulnerabilities in data center infrastructure.

Some newer iRMC firmware versions (S4/S5) may force password change at first login via the Web GUI or iRMC S4 Configuration Wizard. However, not all deployments enforce this, especially when using automated provisioning scripts.

Newer versions enforce strict password policies. A new password must typically meet these criteria: At least .

Characters like capital "I" and lowercase "l" can look identical. Fujitsu recommends using a smartphone to scan the barcode on the ID card to retrieve the exact string.

Almost all Fujitsu PRIMERGY servers have a that also resets iRMC to factory defaults.