Finding MegaRAC BMC assets on your network
Earlier this week, researchers with Eclypsium shared findings on three vulnerabilities present in American Megatrends (AMI) MegaRAC firmware. MegaRAC can be found in many server manufacturers’ Baseboard Management Controllers (BMCs), including AMD, Ampere Computing, ASRock, Asus, ARM, Dell EMC, Gigabyte, HPE, Huawei, Inspur, Lenovo, Nvidia, Qualcomm, Quanta, and Tyan. Successful exploitation of these vulnerabilities can provide an attacker with remote code execution, an administrative shell, and user enumeration. Given American Megatrend’s broad reach across server manufacturers and models the number of systems with vulnerable MegaRAC BMC firmware could be quite large.
These vulnerabilities are scored as CVSS “critical” and “high” severities, and the reported vulnerability details include:
- CVE-2022-40259 (CVSS “critical” score of 9.9) - Remote code execution via Redfish API; requires initial access to an account with callback privileges or higher
- CVE-2022-40242 (CVSS “high” score of 8.3) - Administrative shell via default credentials
- CVE-2022-2827 (CVSS “high” score of 7.5) - User enumeration via API request manipulation
The Eclypsium report does mention that public exposure of vulnerable BMCs appears to be “relatively low compared to recent high-profile vulnerabilities in other infrastructure products.” That said, data centers where many similar servers exist -–including data centers providing cloud-based resources-– could yield many opportunities for an attacker who has attained access, and detection of BMC exploitation can be “complex” and is likely to be missed with traditional EDR/AV.
While American Megatrends has not made a security advisory available at the time of this publication, owners and administrators of systems with MegaRAC BMC firmware should check with their server manufacturers for patched firmware updates.
Mitigations are offered in the Eclypsium report (see the “Mitigations” section), including (but not limited to) the following suggestions:
- Ensure that all remote server management interfaces (e.g. Redfish, IPMI) and BMC subsystems in their environments are on their dedicated management networks and are not exposed externally, and ensure internal BMC interface access is restricted to administrative users with ACLs or firewalls.
- Review vendor default configurations of device firmware to identify and disable built-in administrative accounts and/or use remote authentication where available.
type:"BMC" and (hw:"MegaRAC" or os:"MegaRAC")
You can also locate all BMC assets in your environment by searching your Asset inventory for
type:"BMC", which can then be triaged further.
Get runZero for free
Build your asset inventory in minutes and find potentially vulnerable MegaRAC BMC assets on your network.Start your runZero trial
February 3, 2023
Finding Lexmark printer assets
Printer manufacturer Lexmark recently published details on a vulnerability that affects over 100 of their printer models. Learn how runZero can help you find potentially affected assets.
December 9, 2022
Finding Cisco 7800 and 8800 series IP phone assets on your network
Cisco 7800 and 8800 IP phones can be found in many companies and organizations. Successful exploitation of this vulnerability can provide an unauthenticated attacker in the same network segment or VLAN with remote code execution or denial-of-service capabilities.
October 11, 2022
Finding FortiOS, FortiProxy, and FortiSwitchManager assets on your network
A critical authentication bypass vulnerability was found in the web administration interface of some Fortinet products. Tracked as CVE-2022-40684, successful exploitation of this vulnerability via crafted HTTP and HTTPS requests can provide remote attackers with admin-level …