Vulnerabilityhigh

Additional Supply Chain Vulnerabilities Uncovered in AMI MegaRAC BMC Software

The Hacker Newsby @TheHackersNewsFeb 4, 2023 · 04:22 UTC (Feb 4, 2023)2 min read2 · 1 read

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2022-26872 CVE-2022-40258 CVE-2022-40259 CVE-2022-40242 CVE-2022-2827

Tags: cve-2022-26872 cve-2022-40258 cve-2022-40259 cve-2022-40242 cve-2022-2827 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Published
CVE-2022-26872	AMI Megarac Password reset interception via API	8.8	<1%	Jan 30, 2023
CVE-2022-40242 +2 related CVEs CVE-2022-40259 CVE-2022-2827	MegaRAC Default Credentials Vulnerability	9.8 group max	<1%	Dec 5, 2022
CVE-2022-40258	AMI Megarac Weak password hashes for Redfish & API	5.3	<1%	Jan 31, 2023

From the original article

2 min read at thehackernews.com

Two more supply chain security flaws have been disclosed in AMI MegaRAC Baseboard Management Controller (BMC) software, nearly two months after three security vulnerabilities were brought to light in the same product. Firmware security firm Eclypsium said the two shortcomings were held back until now to provide AMI additional time to engineer appropriate mitigations.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.