Database/Firmware, BMC & network fabric

BMC, firmware and network fabric vulnerabilities

BMC/IPMI/Redfish, BIOS/UEFI, NVLink, InfiniBand, DPU, PDU, and cooling-plant flaws: the management plane under every GPU datacenter. Reboots the slowest, patched the least, and reachable more often than anyone plans for.

883 entries104 critical8 known exploitedFilter and search this layer

2026

2024

2023

2025

2022

2021

2018

AMI MegaRAC SPx (embedded lighttpd web server): Use-after-free in the lighttpd request parser embedded in MegaRAC SPxLowJun 17, 2024
APC UPS Network Management Card 2 (AOS 6.5.6): When Remote Monitoring is turned on and then off again, the credentialsCriticalSep 17, 2019
Intel SSD DC S4500 and SSD DC S4600 series firmware before SCV10150 - improper authentication: Improper authenticationMediumJul 11, 2019
Intel processors (microarchitectural data sampling): MULTI-TENANT ISOLATION: One of the MDS family: store buffersMediumMay 30, 2019
Intel processors (microarchitectural data sampling): MULTI-TENANT ISOLATION: One of the MDS family: load ports retainMediumMay 30, 2019
Intel Server Board / Server System / Compute Module platform firmware: Improper memory initialisation in platformMediumMar 14, 2019
Dell iDRAC9 (Redfish): Redfish interface permission-check flaw enabling privilege escalation to adminHighDec 13, 2018
Dell iDRAC (u-boot): Improper error handling grants access to the u-boot shell — pre-BMC-OS control, i.eMediumDec 13, 2018
HPE iLO 5 (firmware update security restriction bypass): Bypass of the security restrictions that guard iLO 5 firmwareMediumDec 3, 2018
Samsung 840 EVO SSD - disk encryption key exposed through wear-levelled NAND and vendor-specific commands: The driveMediumNov 20, 2018
Crucial/Micron MX100, MX200, MX300; Samsung 840 EVO and 850 EVO (ATA-high mode)MediumNov 20, 2018
Brocade Fabric OS Webtools (firmware update section): A remote authenticated attacker can abuse the WebtoolsHighNov 8, 2018
Eaton UPS 9PX 8000 SP administration panel: CSRF on the change-password function plus reflected XSS: an attacker forcesHighOct 24, 2018
Eaton UPS 9PX 8000 SP web interface: The device's own web page contains the user password in cleartext in the pageMediumOct 24, 2018
Cisco NX-OS / FXOS (LLDP parser): FABRIC DOS: a malformed LLDP frame reloads the switchHighOct 17, 2018
Cisco NX-OS PTP feature (Nexus 5500/5600/6000): FABRIC DOS: an unauthenticated remote attacker takes down a NexusHighOct 17, 2018
QLogic 4Gb Fibre Channel 5.5.2.6.0 and 4/8Gb SAN 7.10.1.20.0 switch modules for IBM BladeCenter: Three undocumentedCriticalOct 10, 2018
TPM 2.0 (S3 sleep PCR reset): Platform Configuration Registers can be reset without a full platform restart by abusingMediumAug 17, 2018
Intel SGX (L1 terminal fault on enclave pages): MULTI-TENANT ISOLATION: Speculative execution lets code outsideHighAug 14, 2018
Intel processors (L1 terminal fault, OS/SMM): The OS-level variant of L1 terminal fault: a local user can speculativelyMediumAug 14, 2018
Intel AMT (HTTP handler) in Intel CSME firmware: A buffer overflow in AMT's HTTP handler allows arbitrary codeHighJul 10, 2018
Intel processors (bounds check bypass store): Spectre 1.1: speculative stores can overflow a bounds-checked bufferMediumJul 10, 2018
Dell iDRAC7 / iDRAC8 / iDRAC9 (SNMP agent): Command injection in the iDRAC SNMP agent gives an attacker who alreadyHighJul 2, 2018
Intel processors (lazy FP state restore): LazyFP: when the OS restores FPU/vector state lazily, one process canMediumJun 21, 2018
Cisco NX-OS / FXOS (Cisco Fabric Services): Unauthenticated remote code execution as root through Cisco FabricCriticalJun 20, 2018
Eaton Intelligent Power Manager v1.6 - node_upgrade_srv.js firmware parameter: Local file inclusion through directoryCriticalJun 7, 2018
Intel processors (rogue system register read): Spectre v3a: speculative reads of system registers leak systemMediumMay 22, 2018
Intel processors (speculative store bypass): Spectre v4: a load speculatively executes before an older storeMediumMay 22, 2018
Schneider Electric MGE Network Management Card Transverse (MGE UPS / MGE STS): The card's integrated web serverCriticalApr 18, 2018
Schneider Electric MGE Network Management Card Transverse (MGE UPS / MGE STS): On default settings without SSL enabledCriticalApr 18, 2018
Arista EOS (BGP UPDATE): Malformed path attribute in a BGP UPDATE from a peer causes denial of serviceHighApr 12, 2018
Juniper Junos OS MACsec key configuration (CKN/CAK): TENANT ISOLATION: if you configure a MACsecUnscoredApr 11, 2018
Intel SGX Platform Software for Linux (AESM daemon): A local attacker can disable the AESM daemonMediumApr 3, 2018
Dell iDRAC7/8: CGI injection giving unauthenticated remote code execution as root on the BMCCriticalMar 23, 2018
Dell iDRAC7 / iDRAC8 (web server URI parser): Directory traversal in the BMC's own HTTP front end lets an attackerHighMar 23, 2018
AMD Secure Processor (Ryzen / Ryzen Pro / Ryzen Mobile): MULTI-TENANT ISOLATION: Insufficient access controlCriticalMar 22, 2018
AMD Secure Processor (Ryzen / Ryzen Pro): MULTI-TENANT ISOLATION: The same class of Secure Processor access-controlCriticalMar 22, 2018
Promontory chipset firmware (AMD Ryzen / Ryzen Pro platforms): MULTI-TENANT ISOLATION: A backdoor in the PromontoryCriticalMar 22, 2018
AMD EPYC / Ryzen - Platform Security Processor privilege escalation: MULTI-TENANT ISOLATION: A direct privilegeCriticalMar 22, 2018
Intel SGX SDK (Edger8r generated code, side channel): Edger8r generated bridge code that was susceptible to a sideMediumMar 20, 2018
Cisco NX-OS (management interface ACL): The ACL you put on the management interface is not enforced, so traffic youHighJan 18, 2018
Intel Baseboard Management Controller firmware before 1.43.91f76955 (Intel server boards and systems): An unprivilegedCritical2018
Power Management Controller (PMC) firmware in systems using Intel CSME 11.x/12.0 or Intel SPS 4.x: An administrativeHigh2018
BMC firmware on Intel server boards, compute modules and systems - SMBus access control: An attackerHigh2018
Intel DCI (Direct Connect Interface) UEFI setting restrictions - Xeon E3 v5/v6, Xeon Scalable, Xeon D: The UEFI settingHigh2018
RoCEv2 lossless Ethernet fabric - IEEE 802.1Qbb Priority Flow Control: FABRIC DOS: RoCE requires a lossless networkHigh2018
AMD SEV memory encryption - host-controlled guest physical to host physical mapping: The original demonstrationUnscored2018
Microsoft BitLocker / Windows eDrive hardware-encryption offload on any TCG Opal or IEEE-1667 self-encrypting driveUnscored2018

2020

2023-2026

2022-2026

NVMe-oF over RDMA: NVMe-over-Fabrics inherits RDMA's lack of authenticationUnscored2022-2026

2021-2026

RDMA / RoCE: RoCE and IB RDMA have no cryptographic authentication of the QP connection setup or of subsequentUnscored2021-2026

2019

2019-2026

2017

2015

2014

Raritan PX rack PDU (before firmware 1.5.11, DPXR20A-16 and related PX models): TENANT ISOLATION: the PDU's IPMICriticalJul 14, 2014

2013-2026

IPMI over LAN as a protocol: IPMI has no transport confidentiality guarantees worth relying on, weak session handlingUnscored2013-2026

2013

2012

Xen on older AMD CPUs - 64-bit PV guest processor erratum: Xen 4.0 and 4.1 running a 64-bit PV guest on older AMD CPUsUnscoredDec 3, 2012

2011