Lanner IAC-AST2500A BMC standard firmware 1.10.0: Arbitrary code execution as root on the BMC, at the maximum severity

Impact

Arbitrary code execution as root on the BMC, at the maximum severity the scale allows. The operator outcome is complete out-of-band ownership of every node carrying this module: power control, boot-device selection, KVM into whatever the tenant has on screen, virtual-media boot of an attacker-supplied image, and an implant in BMC flash that survives host reimaging. Because the IAC-AST2500A is a module dropped into other people's board designs, an operator may be running it without the word 'Lanner' appearing anywhere in their asset inventory. Command injection plus stack buffer overflows in the KillDupUsr_func handler of spx_restservice, the REST service that fronts the BMC web interface. The IAC-AST2500A is a MegaRAC-derived BMC module resold into a wide range of whitebox and edge server designs.

Who can reach it

Network reachability to the BMC's REST service. Anything routable to the out-of-band management VLAN, which for whitebox and edge deployments is frequently less segmented than in a purpose-built datacenter.

What to do

Firmware flash from Lanner, per module. This is the hardest remediation class in this database: Lanner's website returns a blanket Cloudflare 403 to automated clients, the advisories that exist are third-party (Nozomi Networks) rather than vendor-published, and firmware for a resold BMC module often has to be sourced through the board integrator rather than Lanner directly. For many operators the honest answer is that no fixed image is obtainable, and the only real mitigation is hard network isolation of the management VLAN with an explicit allowlist. Inventory first - identify which of your boards carry an IAC-AST2500A before assuming you are unaffected.

References