Security Experts:

Connect with us

Hi, what are you looking for?


Cloud Security

Security Flaws in AMI BMC Can Expose Many Data Centers, Clouds to Attacks

Researchers at firmware and hardware security company Eclypsium have identified several potentially serious vulnerabilities in baseboard management controller (BMC) firmware made by AMI (American Megatrends) and used by some of the world’s biggest server manufacturers.

Researchers at firmware and hardware security company Eclypsium have identified several potentially serious vulnerabilities in baseboard management controller (BMC) firmware made by AMI (American Megatrends) and used by some of the world’s biggest server manufacturers.

Eclypsium started analyzing the firmware in August, after it came across a data leak allegedly originating from AMI. The firm decided to analyze the leaked software to see if it could find any vulnerabilities, to ensure that they get patched in case malicious actors would also be looking for security flaws to exploit.

The analysis focused on AMI’s MegaRAC BMC, which is used by companies such as AMD, Ampere, Asrock, Asus, Arm, Dell, Gigabyte, HPE, Huawei, Inspur, Lenovo, Nvidia, Qualcomm, Quanta, and Tyan.

“This firmware is a foundational component of modern computing found in hundreds of thousands of servers in data centers, server farms, and cloud infrastructure around the world. And since devices in these environments typically standardize on a hardware configuration, a vulnerable configuration could likely be shared across thousands of devices,” Eclypsium said.

“MegaRAC BMC firmware is one of the common threads that connects much of the hardware that underlies the cloud. As a result, any vulnerability in MegaRAC can easily spread through the extended supply chain to affect dozens of vendors and potentially millions of servers,” the company added.

BMC allows administrators to remotely control and monitor a device without having to access the operating system or applications running on it. The BMC can be used to install an operating system, update the firmware, monitor system parameters, and analyze logs — capabilities that can make it a tempting target for threat actors.

Eclypsium’s research of the AMI BMC led to the discovery of three vulnerabilities, which the company collectively tracks as BMC&C. The vulnerabilities can pose a significant risk not only to individual devices, but also to data centers and cloud services.

The most serious of the BMC&C flaws, tracked as CVE-2022-40259 and rated ‘critical’, can be exploited for arbitrary code execution. A low-privileged account is needed for exploitation.

Another flaw, identified as CVE-2022-40242 and rated ‘high severity’, is related to default credentials that allow access with elevated privileges. Access to the targeted device is required for exploiting this vulnerability.

The third issue is also ‘high severity’ and it allows an attacker to conduct user enumeration, which can be useful for brute force or credential stuffing attacks.

“These vulnerabilities could be exploited by an attacker that has gained initial access into a data center or administrative network. As data centers tend to standardize on specific hardware platforms, any BMC-level vulnerability would most likely apply to large numbers of devices and could potentially affect an entire data center and the services that it delivers,” Eclypsium warned in its disclosure.

In a real world attack scenario, a malicious actor could exploit the vulnerabilities to remotely control compromised servers, deploy malware or firmware implants, and cause physical damage to the targeted device.

AMI and other impacted vendors have been notified before Eclypsium disclosed its findings, but even if patches are created, it could take a long time until they’re widely deployed.

Eclypsium’s Scott Scheferman described the coordinated disclosure process as one of the most intense in his career.

“Bottom line: this will likely impact you if you are a cloud-forward organization relying on the implicit trust dynamics of relegating security visibility and vulnerability management of the cloud platform to the cloud provider,” Scheferman said, adding, “These vulns extend to on-site servers and customer-owned data centers as well.”

Eclypsium said it does not know if the vulnerabilities have been exploited for malicious purposes, but it cannot be ruled out considering that the issues were discovered in leaked software that is likely in the possession of multiple threat groups. The cybersecurity firm pointed out that the recently discovered iLOBleed rootkit targets the BMC firmware, which means these types of attacks are not just theoretical.

Related: BMC Firmware Vulnerabilities Expose OT, IoT Devices to Remote Attacks

Related: QCT Servers Affected by ‘Pantsdown’ BMC Vulnerability

Related: NVIDIA Patches AMI BMC Vulnerabilities Impacting Several Major Vendors

Written By

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Click to comment

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Email Security

Microsoft is urging customers to install the latest Exchange Server updates and harden their environments to prevent malicious attacks.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.


Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.