Critical vulnerabilities discovered in Supermicro 's Baseboard Management Controller (BMC) firmware have revealed a worrying pattern where inadequate security patches are creating new attack vectors, allowing sophisticated hackers to bypass Signature Verification mechanisms and maintain persistent access to enterprise server infrastructure.
See also: Chrome: Vulnerabilities allow data leakage & system crashes
These vulnerabilities, which affect multiple generations of Supermicro motherboards, demonstrate how design weaknesses in firmware verification processes can undermine fundamental security assumptions of server hardware.
The vulnerabilities emerged after an investigation into supposedly fixed security issues revealed that the vendor fixes implemented in January 2025 were insufficient to address the underlying certification weaknesses.
The original vulnerability, CVE-2024-10237 , was discovered by NVIDIA 's Offensive Security Research Team and involved fundamental weaknesses in the BMC firmware image certification design that could allow attackers with administrative access to upload malicious firmware updates.
See also: Vulnerability in SolarWinds Web Help Desk allows RCE execution
Binarly analysts identified a bypass technique for the vendor's CVE-2024-10237 patch, resulting in the assignment of CVE-2025-7937. During extensive analysis of different Supermicro products, researchers discovered a similar vulnerability using different exploitation techniques, which was reported as CVE-2025-6198.
Exploitation of this second vulnerability revealed capabilities that extend beyond simple firmware updates, allowing attackers to completely bypass the BMC's Root of Trust (RoT) security feature
The attack methods exploit design weaknesses in the three-step firmware verification process used in all Supermicro BMC implementations. First, the system retrieves a public key from the BMC's SPI flash chip that is part of the currently running firmware, while extracting cryptographic signature values from uploaded image blobs using RSA-4096.
The process then analyzes built-in tables representing different firmware regions, calculating SHA-512 of the signed regions before verifying the signatures against the calculated hashes.
See also: Top 25 MCP vulnerabilities exploited by AI Agents
These vulnerabilities provide attackers with full persistent access to both BMC systems and the servers' primary operating systems, representing a critical escalation path that undermines fundamental hardware security assumptions in enterprise environments.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
