It qualifies as a vulnerability and has been fixed, but the whole fuss is completely overblown though. If an attacker has physical access or access to an iLO, DRAC or other kind of remote console, this vulnerability doesn’t matter worth a damn, it’s already game over.