Hardware and software manufacturer American Megatrends International has been made aware of two (2) critical vulnerabilities in their MegaRAC Baseboard Management Controller (BMC) firmware that, if chained together, could allow unauthenticated attackers to bypass authentication, attain root privileges, and conduct remote code execution (RCE). MegaRAC BMC is a popular firmware used by multiple server manufacturers including AMD, Asus, ARM, Dell EMC, Gigabyte, Lenovo, Nvidia, Qualcomm, Hewlett-Packard Enterprise, Huawei, Ampere Computing, and ASRock to give administrators full remote hardware control in cloud environments. The first and most severe vulnerability, tracked as CVE-2023-34329, is an authentication bypass with a CVSS score of 9.9/10, and the second flaw, tracked as CVE-2023-34330, is a code injection vulnerability with a CVSS score of 6.7/10. These flaws are exploitable by an unauthenticated attacker who has gained access to the network. Combining the two (2) vulnerabilities is achievable from either a compromised host operating system, or through sending malicious HTTP requests to DMTF’s Redfish, an “API standard for the management of a server’s infrastructure and other infrastructure supporting modern data centers.” The chaining of the two (2) vulnerabilities has a combined CVSS score of 10/10 and were discovered by security researchers from Eclypsium after examining AMI source code that was stolen by the RansomEXX ransomware gang during a network breach of GIGABYTE in 2021. According to Eclypsium’s report, these vulnerabilities pose a major risk to the technology supply chain underlying cloud computing. If properly exploited, they could allow threat actors to take “remote control of compromised servers, deploy malware/ransomware, as well as “firmware implanting or bricking motherboard components (BMC or potentially BIOS/UEFI), potential physical damage to servers (over-voltage/firmware bricking), and indefinite reboot loops that a victim organization cannot interrupt.” The flaws have not yet been patched, and Eclypsium has offered mitigation techniques for hardening remote management interfaces, which are linked in the report below. CTIX analysts will continue to follow this matter and will publish updates as necessary.