Loading story…
Researchers at Binarly identified two critical vulnerabilities in Supermicro server motherboards' Baseboard Management Controller (BMC) firmware, CVE-2024-10237 and CVE-2025-6198, that allow attackers to remotely install malicious firmware. The flaws enable adversaries to bypass security checks, including the BMC Root of Trust, and gain persistent, high-level control over affected servers, even surviving operating system reinstalls and hardware changes. One vulnerability stems from an incomplete patch released by Supermicro in January, while the second is a newly discovered issue that further undermines firmware integrity. These vulnerabilities pose a significant risk to data centers and AI infrastructure relying on Supermicro hardware, as infections can be extremely difficult to detect or remediate without specialized protections.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Cisco disclosed **CVE-2026-20200**, a high-severity argument injection flaw in the web-based management interface of Cisco Integrated Management Controller (**IMC**) that allows an authenticated low-privilege attacker to execute arbitrary commands as `root`. The vulnerability, scored **CVSS 8.8**, affects multiple Cisco Unified Computing System standalone releases in the 4.3 and 6.0 branches, and Cisco urged customers to apply updates, validate management-interface inputs, and limit privileges for authenticated users. At the same time, research presented by runZero and reported from Black Hat 2026 warned that baseboard management controllers (**BMCs**) across major vendors remain broadly exposed and vulnerable to takeover. runZero said it found multiple flaws affecting platforms including **OpenBMC, Supermicro IPMI, HPE iLO, Dell iDRAC, AMI MegaRAC, Raritan, H3C HDM, and Fujitsu BMC**, while scans cited by Ars Technica identified more than **86,000** Internet-exposed BMCs and found over **54%** with at least one critical weakness. Researchers said exploitation can enable persistent server backdoors, lateral movement, and segmentation bypass, and recommended isolating BMC interfaces from the public Internet, monitoring vendor advisories, patching promptly, and disabling legacy management features such as IPMI and KCS where possible.
Aug 6, 2026
Researchers at Lava found that **24,650** internet-exposed Baseboard Management Controllers (BMCs) leak password-derived authentication material through `CVE-2013-4786`, a long-known weakness in the IPMI 2.0 handshake over UDP port `623`. Across **36,872** publicly reachable IPMI services identified via Shodan, the exposed systems returned data before login that can be used for **offline password cracking**, bypassing account lockouts and failed-login monitoring. The issue affects out-of-band management interfaces that can grant low-level server control, including remote administration and firmware operations independent of the host operating system. The researchers said they recovered valid credentials for at least a third of tested systems using dictionaries and factory-password patterns, with **Supermicro** devices frequently using predictable 10-character uppercase defaults tied to the `ADMIN` account and **HPE iLO** systems also showing crackable factory schemes. They also observed an exposed **HPE iLO 4** login page displaying a ransom note, indicating at least some BMC interfaces may already have been compromised. Recommended mitigations include removing IPMI and Redfish from the public internet, blocking UDP `623`, rotating factory and weak BMC passwords, disabling legacy IPMI authentication options, and restricting management access to isolated networks, VPNs, or bastion hosts.
Aug 4, 2026
Intel disclosed **CVE-2017-5689** in its manageability firmware, warning that systems using **Intel Active Management Technology (AMT)**, **Intel Standard Manageability (ISM)**, and **Intel Small Business Technology (SBT)** on firmware versions `6.x` through `11.6` could be taken over by an unprivileged attacker. The flaw affected business PCs and some servers with **vPro/AMT** enabled, allowing abuse of management functions that operate below the operating system through the **Intel Management Engine**, and in some cases could be reached remotely over the network on provisioned systems. Researcher **Maksim Malyutin of Embedi** reported the issue to Intel, which tracked it under **INTEL-SA-00075** and later referenced broader guidance in **INTEL-SA-00086**. Embedi said the bug was widely misunderstood as remote code execution, describing it instead as a severe authentication and privilege-escalation weakness that could still enable stealthy compromise through multiple vectors wherever AMT was enabled. Intel said it had no evidence of active exploitation at disclosure, but remediation depended on OEM-supplied, signed firmware updates rather than a direct Intel patch, raising concern that older or unsupported devices might never be fixed. The disclosure also renewed criticism from the **EFF** and other security advocates, who argued that the Management Engine’s privileged, hard-to-disable design creates systemic risk when vulnerabilities emerge in this hidden administrative layer.
Jun 29, 2026