CriticalPublic exploit

Unauthenticated AHB Bridge Access in ASPEED AST2400 and AST2500 BMCs

IdentifiersCVE-2019-6260CWE-653

CVE-2019-6260 is an improper isolation vulnerability in ASPEED AST2400 and AST2500 Baseboard Management Controller hardware and firmware. Several Advanced High-performance Bus bridge and debug mechanisms permit arbitrary reads and writes to the BMC physical address space without authentication. Affected mechanisms include iLPC2AHB bridge variants, PCIe VGA and BMC P2A bridges, X-DMA transfers, the UART-based SoC Debug interface, LPC2AHB, and watchdog setup.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

An attacker able to access an affected bridge can arbitrarily read from and write to BMC physical memory. This bypasses the intended isolation boundary between the host or exposed management-access path and BMC memory.

Remediation

Patch, then assume compromise.

Remediate the underlying improper-isolation condition by separating components and resources operating at different privilege levels, minimizing interfaces between them, and enforcing strong access controls on interfaces that can access BMC physical memory.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

cve-2019-6260MaturityOperationalVerified exploit

This repository is a comprehensive C-based toolset for probing, testing, and manipulating ASPEED BMC (Baseboard Management Controller) hardware via multiple low-level interfaces. It is not a simple proof-of-concept but a mature, operational tool that can be used for both security testing and exploitation of BMCs, particularly those based on ASPEED AST2400, AST2500, and AST2600 chips. **Capabilities:** - Probes for available hardware interfaces (PCIe P2A, iLPC2AHB, LPC2AHB, Debug UART, X-DMA, /dev/mem) and their security posture (e.g., write filters, access permissions). - Reads and writes arbitrary physical memory addresses on the BMC via these interfaces. - Dumps or reflashes BMC firmware and RAM, including live systems. - Replaces memory contents (RAM) with arbitrary data, enabling in-memory patching or exploitation. - Resets the SoC or prevents system resets (useful for persistent access or DoS). - Interacts with the BMC console, including automated login and getty spawning via UART or networked serial concentrators (e.g., Digi Portserver TS 16). - Supports both local (direct hardware) and remote (networked serial) attack vectors. - Provides a modular command-line interface with subcommands for each function (see `doit.c` and README for usage). **Structure:** - The main entry point is `doit.c`, which dispatches to various command modules (e.g., `cmd/read.c`, `cmd/write.c`, `cmd/console.c`, etc.). - Hardware interface abstraction is provided via modules for AHB, LPC, PCIe, UART, and memory-mapped IO. - The tool is portable across x86_64, powerpc64, and armv6 architectures, with architecture-specific code in `arch/`. - Includes a number of utility and support libraries (e.g., for logging, prompts, type checking, etc.). **Purpose:** - Designed for security researchers, firmware developers, and platform security testers to assess the security of ASPEED BMC implementations. - Can be used to exploit insecure BMC configurations (e.g., default-unprotected AHB access, missing write filters) to gain arbitrary code execution, dump secrets, or modify firmware. **Notable Endpoints:** - `/dev/mem` (direct memory access) - `/sys/kernel/debug/powerpc/lpc` (LPC interface) - PCI device files in `/sys/bus/pci/devices/` - Network endpoints for Digi Portserver TS 16 (e.g., `<IP>:23`, `<IP>:2104`) - `/sbin/agetty` (for console access) **Security Impact:** - If used against a vulnerable BMC, this tool can provide full control over the BMC, including persistent firmware modification, memory exfiltration, and system disruption. - The tool is operational and weaponizable, as it automates many steps required for exploitation and supports both local and remote attack surfaces.

nikitapbstDisclosed May 21, 2021cmakefilelocalnetwork

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

AspeedtechAst2400 Firmwareoperating_system

AspeedtechAst2500 Firmwareoperating_system

NetAppFas/Aff Baseboard Management Controllerapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

cwe mitreNews

Jan 23, 2019

CWE - CWE-653: Improper Isolation or Compartmentalization (4.20)

An unauthenticated-access vulnerability in BMC AHB bridges allowing arbitrary reads and writes to the BMC physical address space from the host and potentially the network.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity1