AMI MegaRAC SPx (BMC cryptography / HMAC): The BMC uses inadequate HMAC strength, so an attacker positioned

Impact

The BMC uses inadequate HMAC strength, so an attacker positioned on the management network can forge or replay authenticated material rather than having to break in. The practical outcome is impersonating a legitimate management session and issuing privileged BMC operations - power, virtual media, firmware update - without ever holding a valid password. AMI scores the scope as changed, i.e. the consequences land outside the BMC.

Who can reach it

Adjacent network with a low-privilege foothold and some user interaction, at high attack complexity. Realistically this is an attacker already sitting on the management VLAN who can observe or interpose on BMC traffic, e.g. after compromising a management jump host or a switch on that segment.

What to do

Firmware flash to SPx_12.2 / SPx_13.0 or later - this one has been fixed for a long time, so the operator question is whether your ODM image is actually from a fixed branch, not whether AMI shipped a fix. Audit the running BMC build across the fleet before assuming it. Until then, force TLS everywhere on the BMC, disable the plain-HTTP and legacy management listeners, and keep the management plane on its own switched segment so there is nowhere to interpose.

References

Related entries

• AMI MegaRAC SPx (BMC cryptography / HMAC): A step is missing when the BMC generates its HMAC, so the authentication tagCVE-2023-34471 · AMI MegaRAC SPx (BMC cryptography / HMAC)Medium
• Dell iDRAC9 (IPMI 2.0 over LAN): iDRAC9 generates predictable IPMI 2.0 session IDs, so an attacker can hijack somebodyCVE-2024-25943 · Dell iDRAC9 (IPMI 2.0 over LAN)High
• IBM Power Systems Firmware: unauthenticated ASMI web request crashes the service-processor interfaceCVE-2026-16828 · IBM Power Systems Firmware ASMI web interfaceHigh
• Opengear console server: Authentication bypass in the console server allowing remote attackers to modify settingsCVE-2011-3997 · Opengear console serverHigh
• Supermicro IPMI BMC firmware - hardcoded WSMAN credentials (X9 before SMT_X9_315, X8 before SMT X8 312): The BMCCVE-2013-3620 · Supermicro IPMI BMC firmware - hardcoded WSMAN credentials (X9 before SMT_X9_315, X8 before SMT X8 312)High
• IBM Integrated Management Module (IMM/IMM2) IPMI 2.0 RAKP implementation: The vendor-acknowledged instance of the IPMICVE-2013-4037 · IBM Integrated Management Module (IMM/IMM2) IPMI 2.0 RAKP implementationHigh