New Supermicro BMC flaws can create persistent backdoors
Attackers can update computers with deliberately created images thanks to two flaws in the firmware of Supermicro devices, notably the Baseboard Management Controller (BMC).
Supermicro manufactures data center gear, motherboards, and servers. Supermicro server motherboards have a microprocessor called BMC that enables remote system management and monitoring even when the system is not in use.
Along with another vulnerability known as CVE-2025-6198, experts at the firmware security firm Binarly found a workaround for a weakness (CVE-2024-10237) that Supermicro addressed this year in January.
According to Binarly experts, this security flaw can provide possible attackers total and long-term access over the primary server OS as well as the BMC system.
The researchers claim that C...