RansomwarecriticalExploited in the wild

Critical Flaws in AMI MegaRAC BMC Software Expose Servers to Remote Attacks

The Hacker Newsby @TheHackersNewsJul 26, 2023 · 17:38 UTC (Jul 26, 2023)2 min read2 · 1 read

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2022-40259 CVE-2022-40242 CVE-2022-2827 CVE-2022-26872 CVE-2022-40258 CVE-2023-34329 CVE-2023-34330

Tags: cve-2022-40259 cve-2022-40242 cve-2022-2827 cve-2022-26872 cve-2022-40258 ransomware

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Published
CVE-2022-26872	AMI Megarac Password reset interception via API	8.8	<1%	Jan 30, 2023
CVE-2022-40242 +2 related CVEs CVE-2022-40259 CVE-2022-2827	MegaRAC Default Credentials Vulnerability	9.8 group max	<1%	Dec 5, 2022
CVE-2022-40258	AMI Megarac Weak password hashes for Redfish & API	5.3	<1%	Jan 31, 2023
CVE-2023-34330 +1 related CVE CVE-2023-34329	AMI SPx contains a vulnerability in the BMC where a user may inject code which could be executed via a Dynamic Redfish Extension interface	8.8 group max	<1%	Jul 18, 2023

From the original article

2 min read at thehackernews.com

 Ravie Lakshmanan  Jul 20, 2023 Hardware Security / SysAdmin Two more security flaws have been disclosed in AMI MegaRAC Baseboard Management Controller (BMC) software that, if successfully exploited, could allow threat actors to remotely commandeer vulnerable servers and deploy malware.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.