Greater than a dozen new BMC firmware flaws expose OT and IoT units to distant assaults

November 28, 2022Ravie Lakshmanan

Greater than a dozen safety flaws have been found in Lanner’s baseboard administration controller (BMC) firmware that would expose operational expertise (OT) and Web of Issues (IoT) networks. ) to ranged assaults.

BMC refers to a specialised service processor, a system on a chip (SoC), which is present in server motherboards and is used for distant monitoring and administration of a bunch system, together with operating computer systems. low-level system operations resembling firmware flashing and energy management. .

Nozomi Networks, which analyzed an Clever Platform Administration Interface (IPMC) from Taiwanese vendor Lanner Electronics, stated it discovered 13 weaknesses affecting IAC-AST2500.

All points have an effect on model 1.10.0 of the usual firmware, aside from CVE-2021-4228, which impacts model 1.00.0. 4 of the failings (CVE-2021-26727 to CVE-2021-26730) are rated 10 out of 10 on the CVSS score system.

Specifically, the economic safety agency found that CVE-2021-44467, an entry management bug within the internet interface, may very well be chained with CVE-2021-26728, a buffer overflow flaw, to get the distant code execution on the BMC with root privileges. .

“Additionally contemplating that each one processes are operating with root privileges on the gadget, the mixed weaknesses permit an unauthenticated attacker to fully compromise each the BMC and the managed host,” stated the corporate in an article revealed final week.

Lanner has since launched up to date firmware that addresses the vulnerabilities in query following accountable disclosure.

“BMCs signify a pretty approach to simply monitor and handle pc methods with out requiring bodily entry, within the IT area in addition to within the OT/IoT area,” the researchers stated.

“However, their user-friendliness comes at the price of a bigger assault floor, which may result in a rise in total danger if they aren’t sufficiently protected.”