BMC&C: Lights Out Forever

Introduction

Earlier this year, Eclypsium Research discovered and reported 5 vulnerabilities in American Megatrends (AMI) MegaRAC Baseboard Management Controller (BMC) software. MegaRAC BMC is a critical supply chain component found in millions of devices worldwide and used by multiple top-tier manufacturers to deliver “lights-out” management for servers.

Today, Eclypsium Research is disclosing a pair of additional BMC&C vulnerabilities in the same AMI MegaRAC BMC software. These new vulnerabilities range in severity from High to Critical, including unauthenticated remote code execution …

american american megatrends ami amp baseboard management controller bmc critical devices eclypsium introduction management megarac research servers software supply supply chain today vulnerabilities