MegaRAC flaws, IP leak impact multiple server brands

Home/BOTNET, Compromised, Exploitation, hackers, Internet Security, IOC's, malicious cyber actors, Malicious extension, Malware, Mobile Security, Security Advisory, Security Update, Software Issues, Targeted Attacks, Tips/MegaRAC flaws, IP leak impact multiple server brands

MegaRAC flaws, IP leak impact multiple server brands

Research team has found three different vulnerabilities in the MegaRAC Baseboard Management Controller (BMC) software.

CVE-2022-40259 and CVE-2022-40242 vulnerabilities have CVSS scores of 9.8, while the CVE-2022-2827 vulnerability has a CVSS score of 7.5 on the National Vulnerability Database (NVD).

MegaRAC is a BMC software implementation developed by American Megatrends (AMI), which is also one of the largest providers of UEFI/BIOS firmware for computers. Manufacturers known to have used MegaRAC BMC in at least some of their products include AMD, Ampere Computing, ASRock, Asus, ARM, Dell EMC, Gigabyte, Hewlett-Packard Enterprise, Huawei, Inspur, Lenovo, NVidia, Qualcomm, Quanta, and Tyan.

CVE-2022-40259 (CVSS 9.5) – an arbitrary code execution vulnerability in the Redfish API implementation. A specially crafted exploit from an attacker with minimum access to the target device could trigger the flaw.

CVE-2022-40242 (CVSS 8.3) – Default credentials for UID = 0 shell via SSH. The researchers stated that they found “a hash in etc/shadow for the sysadmin user,” cracking, which made them reach the default credentials. Exploiting this vulnerability merely requires an attacker to have remote access to the target device.

CVE-2022-2827 (CVSS 7.5) – when resetting the password, one of the parameters could allow an adversary to discover various user accounts by querying possible usernames. It then allows the attacker to perform credential stuffing or brute force attacks against those accounts.

These vulnerabilities pose a serious risk because they could lead to supply chain attacks. Many server manufacturers, including NVidia, AMD, Asus, Huawei, Lenovo, Quanta, and Dell EMC, use MegaRAC BMC. 

Versions Affected

ProductsVersions
AMI MegaRAC SPx120 – 6.00
AMI MegaRAC SPx130 – 4.00

Mitigations for the MegaRAC BMC vulnerabilities

  • Make sure critical firmware and remote server management subsystems (like MegaRAC, iDRAC, iLO, etc.) are covered in vulnerability assessments. 
  • Server owners should also review the default configurations on their BMCs and disable default accounts or change default passwords. 
  • Make sure the software is up-to-date and remove unnecessary remote access.
Post Views: 468
By | 2022-12-14T09:37:48+05:30 December 13th, 2022|BOTNET, Compromised, Exploitation, hackers, Internet Security, IOC's, malicious cyber actors, Malicious extension, Malware, Mobile Security, Security Advisory, Security Update, Software Issues, Targeted Attacks, Tips|

About the Author:

FirstHackersNews- Identifies Security

Related Posts

Leave A Comment

Subscribe to our newsletter to receive security tips everday!