Supermicro Security Slip-Up: Firmware Flaws Leave BMC Vulnerable to Hacker Shenanigans
Two security vulnerabilities in Supermicro Baseboard Management Controller firmware have been revealed, enabling attackers to bypass crucial verification steps with a specially crafted image. These vulnerabilities, CVE-2025-7937 and CVE-2025-6198, stem from improper cryptographic signature verification, potentially allowing for unauthorized firmware updates and leading to complete control over the system.
Hot Take:
Who knew that “Root of Trust” was more like “Root of Rust”? Supermicro’s BMC firmware is about as secure as a screen door on a submarine, and hackers are diving right in! It’s time for Supermicro to Superfix their vulnerabilities before their systems become the next cyber colander.
Key Points:
– Two medium-severity vulnerabilities (CVE-2025-7937 and CVE-2025-6198) found in Supermicro’s BMC firmware.
– Both vulnerabilities involve bypassing cryptographic signature verification, allowing unauthorized firmware updates.
– CVE-2025-7937 is a bypass for a previously disclosed vulnerability, CVE-2024-10237.
– Successful exploitation can grant attackers persistent control over BMC systems and potentially main server OS.
– Research suggests Supermicro’s Root of Trust is not as secure as previously claimed.