Researchers at firmware and hardware security company Eclypsium have identified several potentially serious vulnerabilities in baseboard management controller (BMC) firmware made by AMI (American Megatrends) and used by some of the world’s biggest server manufacturers.
Eclypsium started analyzing the firmware in August, after it came across a data leak allegedly originating from AMI. The firm decided to analyze the leaked software to see if it could find any vulnerabilities, to ensure that they get patched in case malicious actors would also be looking for security flaws to exploit.
The analysis focused on AMI’s MegaRAC BMC, which is used by companies such as AMD, Ampere, Asrock, Asus, Arm, Dell, Gigabyte, HPE, Huawei, Inspur, Lenovo, Nvidia, Qualcomm, Quanta, and Tyan.
“This firmware is a foundational component of modern computing found in hundreds of thousands of servers in data centers, server farms, and cloud infrastructure around the world. And since devices in these environments typically standardize on a hardware configuration, a vulnerable configuration could likely be shared across thousands of devices,” Eclypsium said.
“MegaRAC BMC firmware is one of the common threads that connects much of the hardware that underlies the cloud. As a result, any vulnerability in MegaRAC can easily spread through the extended supply chain to affect dozens of vendors and potentially millions of servers,” the company added.
BMC allows administrators to remotely control and monitor a device without having to access the operating system or applications running on it. The BMC can be used to install an operating system, update the firmware, monitor system parameters, and analyze logs — capabilities that can make it a tempting target for threat actors.
Eclypsium’s research of the AMI BMC led to the discovery of three vulnerabilities, which the company collectively tracks as BMC&C. The vulnerabilities can pose a significant risk not only to individual devices, but also to data centers and cloud services.
The most serious of the BMC&C flaws, tracked as CVE-2022-40259 and rated ‘critical’, can be exploited for arbitrary code execution. A low-privileged account is needed for exploitation.
Another flaw, identified as CVE-2022-40242 and rated ‘high severity’, is related to default credentials that allow access with elevated privileges. Access to the targeted device is required for exploiting this vulnerability.
The third issue is also ‘high severity’ and it allows an attacker to conduct user enumeration, which can be useful for brute force or credential stuffing attacks.
“These vulnerabilities could be exploited by an attacker that has gained initial access into a data center or administrative network. As data centers tend to standardize on specific hardware platforms, any BMC-level vulnerability would most likely apply to large numbers of devices and could potentially affect an entire data center and the services that it delivers,” Eclypsium warned in its disclosure.
In a real world attack scenario, a malicious actor could exploit the vulnerabilities to remotely control compromised servers, deploy malware or firmware implants, and cause physical damage to the targeted device.
AMI and other impacted vendors have been notified before Eclypsium disclosed its findings, but even if patches are created, it could take a long time until they’re widely deployed.
Eclypsium’s Scott Scheferman described the coordinated disclosure process as one of the most intense in his career.
“Bottom line: this will likely impact you if you are a cloud-forward organization relying on the implicit trust dynamics of relegating security visibility and vulnerability management of the cloud platform to the cloud provider,” Scheferman said, adding, “These vulns extend to on-site servers and customer-owned data centers as well.”
Eclypsium said it does not know if the vulnerabilities have been exploited for malicious purposes, but it cannot be ruled out considering that the issues were discovered in leaked software that is likely in the possession of multiple threat groups. The cybersecurity firm pointed out that the recently discovered iLOBleed rootkit targets the BMC firmware, which means these types of attacks are not just theoretical.
Related: BMC Firmware Vulnerabilities Expose OT, IoT Devices to Remote Attacks
Related: QCT Servers Affected by ‘Pantsdown’ BMC Vulnerability
Related: NVIDIA Patches AMI BMC Vulnerabilities Impacting Several Major Vendors

Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Unpatched Econolite Traffic Controller Vulnerabilities Allow Remote Hacking
- Google Fi Data Breach Reportedly Led to SIM Swapping
- Microsoft’s Verified Publisher Status Abused in Email Theft Campaign
- British Retailer JD Sports Discloses Data Breach Affecting 10 Million Customers
- Meta Awards $27,000 Bounty for 2FA Bypass Vulnerability
- Industry Reactions to Hive Ransomware Takedown: Feedback Friday
- US Reiterates $10 Million Reward Offer After Disruption of Hive Ransomware
- Hive Ransomware Operation Shut Down by Law Enforcement
Latest News
- Malicious NPM, PyPI Packages Stealing User Information
- VMware Confirms Exploit Code Released for Critical vRealize Logging Vulnerabilities
- 98% of Firms Have a Supply Chain Relationship That Has Been Breached: Analysis
- Dutch, European Hospitals ‘Hit by Pro-Russian Hackers’
- Gem Security Gets $11 Million Seed Investment for Cloud Incident Response Platform
- Ransomware Leads to Nantucket Public Schools Shutdown
- Stop, Collaborate and Listen: Disrupting Cybercrime Networks Requires Private-Public Cooperation and Information Sharing
- Boxx Insurance Raises $14.4 Million in Series B Funding
