AMI MegaRAC SPx 12 / SPx 13 (BMC network service): The twin of CVE-2023-37293: a stack smash in the BMC's

Impact

The twin of CVE-2023-37293: a stack smash in the BMC's network-facing path that hands an unauthenticated attacker execution on the management controller. Once there the attacker can hold power control over the node indefinitely, mount virtual media to boot an attacker image, read whatever the BMC can see, and write persistent firmware. The persistence is the point - this survives OS reinstall, disk replacement and node rebuild, so a fleet operator who rotates a suspect node back into the pool reintroduces the implant.

Who can reach it

Adjacent network, unauthenticated, low complexity. Reachable from anything sharing the BMC's broadcast domain. No tenant credentials, no BMC credentials, no clicking required.

What to do

Firmware flash to SPx_12.7 / SPx_13.6 - out-of-band, per node, gated on your ODM publishing a rebased image. Budget for a fleet-wide BMC flash campaign, not a patch window: BMC images are not managed by your OS config management and each SKU needs its own tested build. Config-only interim mitigation is VLAN isolation of the BMC plane plus removing any tenant-network route to it; disabling IPMI-over-LAN does not close this one because the exposure is the BMC's own network stack.

References