A shared library inside Supermicro BMC firmware that parses request headers: An authenticated attacker overflows

CVSS 5.5CVE-2025-8404Firmware, BMC & network fabriccurated

Impact

An authenticated attacker overflows a stack buffer during header parsing and executes code in the BMC firmware operating system. The shared-library location is what makes this worth flagging separately: fixing one web endpoint does not fix it, and the same primitive is likely reachable from whichever BMC service an operator has left enabled. Outcome is the usual BMC-root outcome - out-of-band power, console, virtual media and firmware persistence under the host. Because it is shared, the same overflow is reachable from more than one front-end service on the controller rather than from a single CGI endpoint.

Who can reach it

Any authenticated session that reaches a BMC service using this library over the network. Because it is shared code, restricting one interface does not close it.

What to do

Firmware flash from Supermicro's November 2025 BMC/IPMI batch. Disabling individual BMC services is a weaker mitigation than usual here, since the bug lives in shared parsing code rather than one handler - so treat network isolation of the management VLAN plus per-node unique BMC credentials as the interim control, and prioritise the flash. Expect the fixed image to be board-specific.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-8404 https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2025/8xxx/CVE-2025-8404.json

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.