Lanner IAC-AST2500A BMC firmware 1.10.0: Root on the BMC without any credential at all, because the vulnerable handler

Impact

Root on the BMC without any credential at all, because the vulnerable handler is the login handler. This is the single worst entry in the ODM section: an attacker with a network path and nothing else takes complete out-of-band control of the node - power, console, virtual media, and persistent firmware residency below every layer the operator can reimage. On bare-metal rental this destroys the tenant handoff guarantee, because a node compromised this way stays compromised through wipe and reprovision. Command injection and multiple stack buffer overflows in the Login_handler_func function of spx_restservice, i.e. in the code that runs before anyone has authenticated.

Who can reach it

Anything that can reach the BMC's REST service over the network, unauthenticated. No credential, no host access, no prior foothold - only routability to the management interface.

What to do

Firmware flash from Lanner or your board integrator. As with the rest of this cluster, obtaining a fixed image is the real obstacle: the vendor's site is WAF-blocked to automated access and the public advisories are third-party. Given the unauthenticated nature of this one, treat network isolation as mandatory and immediate rather than as a stopgap - these BMCs must not be reachable from anything except a small, explicitly allowlisted set of management hosts, and never from a tenant or general corporate network. If you cannot obtain fixed firmware, document the residual risk and plan the hardware out.

References