See runZero in action

Contact us to book a demo with our team.

Finding MegaRAC BMC assets on your network

(updated ), by Pearce Barry

Earlier this week, researchers with Eclypsium shared findings on three vulnerabilities present in American Megatrends (AMI) MegaRAC firmware. MegaRAC can be found in many server manufacturers’ Baseboard Management Controllers (BMCs), including AMD, Ampere Computing, ASRock, Asus, ARM, Dell EMC, Gigabyte, HPE, Huawei, Inspur, Lenovo, Nvidia, Qualcomm, Quanta, and Tyan. Successful exploitation of these vulnerabilities can provide an attacker with remote code execution, an administrative shell, and user enumeration. Given American Megatrend’s broad reach across server manufacturers and models the number of systems with vulnerable MegaRAC BMC firmware could be quite large.

What is the impact? #

These vulnerabilities are scored as CVSS “critical” and “high” severities, and the reported vulnerability details include:

  • CVE-2022-40259 (CVSS “critical” score of 9.9) - Remote code execution via Redfish API; requires initial access to an account with callback privileges or higher
  • CVE-2022-40242 (CVSS “high” score of 8.3) - Administrative shell via default credentials
  • CVE-2022-2827 (CVSS “high” score of 7.5) - User enumeration via API request manipulation

The Eclypsium report does mention that public exposure of vulnerable BMCs appears to be “relatively low compared to recent high-profile vulnerabilities in other infrastructure products.” That said, data centers where many similar servers exist -–including data centers providing cloud-based resources-– could yield many opportunities for an attacker who has attained access, and detection of BMC exploitation can be “complex” and is likely to be missed with traditional EDR/AV.

Are updates available? #

While American Megatrends has not made a security advisory available at the time of this publication, owners and administrators of systems with MegaRAC BMC firmware should check with their server manufacturers for patched firmware updates.

Mitigations are offered in the Eclypsium report (see the “Mitigations” section), including (but not limited to) the following suggestions:

  • Ensure that all remote server management interfaces (e.g. Redfish, IPMI) and BMC subsystems in their environments are on their dedicated management networks and are not exposed externally, and ensure internal BMC interface access is restricted to administrative users with ACLs or firewalls.
  • Review vendor default configurations of device firmware to identify and disable built-in administrative accounts and/or use remote authentication where available.

How do I find potentially vulnerable MegaRAC BMC assets with runZero? #

From the Asset Inventory, use the following pre-built query to locate BMC assets running MegaRAC firmware which may need remediation:

type:"BMC" and (hw:"MegaRAC" or os:"MegaRAC")
The prebuilt query is available in the Queries Library

You can also locate all BMC assets in your environment by searching your Asset inventory for type:"BMC", which can then be triaged further.

As always, any prebuilt queries are available from our Queries Library. Check out the library for other useful inventory queries.

Get runZero for free

Build your asset inventory in minutes and find potentially vulnerable MegaRAC BMC assets on your network.

Start your runZero trial
Join our team
Pearce Barry
Written by Pearce Barry

Pearce Barry is a Director of Security Research at runZero. Barry joined runZero in June 2021, working on the Metasploit Project the four years prior. Now, Pearce leads research efforts at runZero, which includes creating and improving fingerprints, adding to protocols, enhancing scanning logic, and writing queries.

Similar Content

November 9, 2023

How to find SysAid Help Desk instances

How to find SysAid Help Desk instances # On the evening of November 8th Microsoft Threat Intelligence announced that they had discovered attacks by a ransomware gang against the SysAid Help Desk software using a zero-day exploit (CVE-2023-47246). These attacks leveraged a …

Read More

November 1, 2023

How to find Apache ActiveMQ instances

How to find Apache ActiveMQ® instances # On October 25th the Apache team announced a vulnerability (CVE-2023-46604) in ActiveMQ that could lead to unauthenticated remote code execution. Shortly after the issue was disclosed exploits started to appear and the Rapid7 MDR team …

Read More

October 30, 2023

Finding NGINX Ingress Controllers with runZero

Today, three vulnerabilities in the NGINX Ingress Controller for Kubernetes were disclosed, as described in this article from The Hacker News. These vulnerabilities have CVSS scores ranging from 7.6 to 8.8; all of these scores are considered high. These vulnerabilities have …

Read More