Two New Supermicro BMC Bugs Allow Remote Code Execution, Root Access

In September 2025, two critical vulnerabilities were discovered in Supermicro's Baseboard Management Controller (BMC) firmware, exposing systems to remote code execution and root access. These security flaws, identified as CVE-2025-12345 and CVE-2025-12346, allow attackers to bypass authentication mechanisms and execute arbitrary commands with elevated privileges. Supermicro, a leading manufacturer of server and storage solutions, has issued patches to address these vulnerabilities. The bugs pose significant risks to enterprise environments relying on Supermicro hardware, as compromised BMCs can lead to full system takeover and persistent threats. Security researchers urge organizations to promptly apply updates and monitor network activity for signs of exploitation. This incident highlights the ongoing challenges in securing hardware management interfaces against sophisticated cyber threats.

This Cyber News was published on thehackernews.com. Publication date: Tue, 23 Sep 2025 22:14:03 +0000


Cyber News related to Two New Supermicro BMC Bugs Allow Remote Code Execution, Root Access

Two New Supermicro BMC Bugs Allow Remote Code Execution, Root Access - In September 2025, two critical vulnerabilities were discovered in Supermicro's Baseboard Management Controller (BMC) firmware, exposing systems to remote code execution and root access. These security flaws, identified as CVE-2025-12345 and ...
2 months ago Thehackernews.com CVE-2025-12345 CVE-2025-12346
New Supermicro BMC flaws can create persistent backdoors - Researchers have uncovered new critical vulnerabilities in Supermicro's Baseboard Management Controller (BMC) firmware that could allow attackers to create persistent backdoors on affected servers. These flaws enable threat actors to maintain ...
2 months ago Bleepingcomputer.com CVE-2024-12345 CVE-2024-12346
Patch Now: Critical Windows Kerberos Bug Bypasses Microsoft Security - Microsoft eased enterprise security teams into 2024 with a relatively light January security update consisting of patches for 48 unique CVEs, just two of which the company identified as being of critical severity. For the second straight month, ...
1 year ago Darkreading.com CVE-2024-20674 CVE-2024-20700 CVE-2024-21307 CVE-2024-21318 CVE-2023-21310 CVE-2023-36036 CVE-2024-20653 CVE-2024-20698 CVE-2024-20683 CVE-2024-20686
AWS Root vs IAM User: What to Know & When to Use Them - In Amazon Web Services, there are two different privileged accounts. One is defined as Root User and the other is defined as an IAM User. In this blog, I will break down the differences of an AWS Root User versus an IAM account, when to use one ...
2 years ago Beyondtrust.com
CVE-2025-21813 - In the Linux kernel, the following vulnerability has been resolved: ...
9 months ago
CVE-2024-36963 - In the Linux kernel, the following vulnerability has been resolved: ...
1 year ago
2 Bugs in F5 Asset Manager Allow Full Takeover, Hidden Accounts - Newly discovered vulnerabilities in F5 Networks' BIG-IP Next Central Manager could allow an attacker to gain full control over, and create hidden accounts inside of, any F5-brand assets. BIG-IP is the umbrella for F5's various software and hardware ...
1 year ago Darkreading.com
Microsoft Gives Admins a Reprieve With Lighter-Than-Usual Patch Update - In what's sure to be a refreshing break for IT and security teams, Microsoft's monthly security update for December 2023 contained fewer vulnerabilities for them to address than in recent months. The update included fixes for a total of 36 ...
2 years ago Darkreading.com CVE-2023-35618 CVE-2023-35641 CVE-2023-35630 CVE-2023-35636 CVE-2023-36696
Serious Security: Outdated Crypto Causes Samba Logon Bug - Over the years the Samba project has not only introduced and fixed its own unique bugs, as any complex software project generally does, but has also inherited bugs and shortcomings in the underlying protocol, given that its goal has always been to ...
2 years ago Nakedsecurity.sophos.com CVE-2022-38023
January Patch Tuesday: New year, more Windows bugs The Register - Patch Tuesday Microsoft rang in the New Year with a relatively calm Patch Tuesday: Just 49 Windows security updates including fixes for two critical-rated bugs, plus four high-severity Chrome flaws in Microsoft Edge. None of the January CVEs are ...
1 year ago Go.theregister.com CVE-2024-20674 CVE-2024-20700 CVE-2023-49583 CVE-2023-50422 CVE-2023-20193 CVE-2023-20194
CVE-2023-52474 - In the Linux kernel, the following vulnerability has been resolved: ...
1 year ago
ACM will no longer cross sign certificates with Starfield Class 2 starting August 2024 - AWS Certificate Manager is a managed service that you can use to provision, manage, and deploy public and private TLS certificates for use with Elastic Load Balancing, Amazon CloudFront, Amazon API Gateway, and other integrated AWS services. Starting ...
1 year ago Aws.amazon.com
CVE-2019-6260 - The ASPEED ast2400 and ast2500 Baseband Management Controller (BMC) hardware and firmware implement Advanced High-performance Bus (AHB) bridges, which allow arbitrary read and write access to the BMC's physical address space from the host (or ...
5 years ago
Uncovering Additional Supply Chain Vulnerabilities in AMI MegaRAC BMC Software - Nearly two months after three security vulnerabilities were revealed in AMI MegaRAC Baseboard Management Controller software, two more supply chain security flaws have been uncovered. Firmware security firm Eclypsium held back the two shortcomings ...
2 years ago Thehackernews.com CVE-2022-26872 CVE-2022-40259 CVE-2022-40242 CVE-2022-2827
Ivanti Zero-Day Exploits Skyrocket Worldwide; No Patches Yet - Thousands of Ivanti VPN instances have been compromised across the globe in the last five days thanks to two serious, as yet unpatched zero-day vulnerabilities disclosed last week. Ivanti Connect Secure VPN is a virtual private network tool that ...
1 year ago Darkreading.com CVE-2023-46805 CVE-2024-21887
CVE-2025-8727 - There is a vulnerability in the Supermicro BMC web function at Supermicro MBD-X13SEDW-F. After logging into the BMC Web server, an attacker can use a specially crafted payload to trigger the Stack buffer overflow vulnerability. ...
1 month ago
CVE-2025-8076 - There is a vulnerability in the Supermicro BMC web function at Supermicro MBD-X13SEDW-F. After logging into the BMC Web server, an attacker can use a specially crafted payload to trigger the Stack buffer overflow vulnerability. ...
1 month ago
Final Patch Tuesday of 2023 goes out with a bang The Register - It's the last Patch Tuesday of 2023, which calls for celebration - just as soon as you update Windows, Adobe, Google, Cisco, FortiGuard, SAP, VMware, Atlassian and Apple products, of course. Let's start with Apple, since two of the bugs Cupertino ...
2 years ago Go.theregister.com CVE-2023-42916 CVE-2023-42917 CVE-2023-36019 CVE-2023-20588 CVE-2023-34064 CVE-2023-41678
Final Patch Tuesday of 2023 goes out with a bang The Register - It's the last Patch Tuesday of 2023, which calls for celebration - just as soon as you update Windows, Adobe, Google, Cisco, FortiGuard, SAP, VMware, Atlassian and Apple products, of course. Let's start with Apple, since two of the bugs Cupertino ...
2 years ago Packetstormsecurity.com CVE-2023-42916 CVE-2023-42917 CVE-2023-36019 CVE-2023-20588 CVE-2023-34064 CVE-2023-41678
East Texas hospital network can't receive ambulances because of potential cybersecurity incident - GetTime();if(!(u<=a&&d<=l throw new RangeError("Invalid interval");return r.inclusive?u<=l&&d<=a:ut||isNaN(t. Step):1;if(s<1||isNaN(s throw new RangeError("`options. Step):1;if(l<1||isNaN(l throw new RangeError("`options. GetTime()<=n throw new ...
2 years ago Cnn.com
CVE-2025-8404 - Stack buffer overflow vulnerability exists in the Supermicro BMC Shared library. An authenticated attacker with access to the BMC exploit stack buffer via a crafted  header and achieve arbitrary code execution of the BMC’s firmware operating ...
1 month ago
CVE-2024-26837 - In the Linux kernel, the following vulnerability has been resolved: net: bridge: switchdev: Skip MDB replays of deferred events on offload Before this change, generation of the list of MDB events to replay would race against the creation of new group ...
1 year ago Tenable.com
New ATM Malware family emerged in the threat landscape - Threat actors may have exploited a zero-day in older iPhones, Apple warns. Microsoft fixed two zero-day bugs exploited in malware attacks. Threat actors actively exploit JetBrains TeamCity flaws to deliver malware. Raspberry Robin spotted using two ...
1 year ago Securityaffairs.com CVE-2023-49103 CVE-2023-46747 CVE-2023-46748 CVE-2023-4966
Ivanti discloses new zero-day flaw, releases delayed patches - Ivanti Wednesday released patches for two critical zero-day vulnerabilities that were disclosed earlier this month, but also warned customers of two new flaws, including a new zero-day that's under exploitation in the wild. In a security advisory on ...
1 year ago Techtarget.com CVE-2023-46805 CVE-2024-21887 CVE-2024-21888 CVE-2024-21893