AMI MegaRAC SPx (BMC cryptography / HMAC): The BMC uses inadequate HMAC strength, so an attacker positioned

Impact

The BMC uses inadequate HMAC strength, so an attacker positioned on the management network can forge or replay authenticated material rather than having to break in. The practical outcome is impersonating a legitimate management session and issuing privileged BMC operations - power, virtual media, firmware update - without ever holding a valid password. AMI scores the scope as changed, i.e. the consequences land outside the BMC.

Who can reach it

Adjacent network with a low-privilege foothold and some user interaction, at high attack complexity. Realistically this is an attacker already sitting on the management VLAN who can observe or interpose on BMC traffic, e.g. after compromising a management jump host or a switch on that segment.

What to do

Firmware flash to SPx_12.2 / SPx_13.0 or later - this one has been fixed for a long time, so the operator question is whether your ODM image is actually from a fixed branch, not whether AMI shipped a fix. Audit the running BMC build across the fleet before assuming it. Until then, force TLS everywhere on the BMC, disable the plain-HTTP and legacy management listeners, and keep the management plane on its own switched segment so there is nowhere to interpose.

References