Quanta Cloud Technology (QCT) patched a critical flaw after researchers from the cybersecurity firm Eclypsium disclosed the presence of the notorious “Pantsdown” vulnerability affecting multiple ASPEED Baseboard Management Controller (BMC) firmware stacks and hardware used in some QCT data center servers. The ASPEED BMC implements Advanced High-performance Bus (AHB) bridges, which allow for arbitrary read/write access to the BMC physical host address or network address. This vulnerability, tracked as CVE-2019-6260, specifically impacts the AHB bridges, and successful exploitation could allow unauthorized attackers to perform arbitrary remote code execution (RCE) to overwrite the current BMC firmware, allowing them to backdoor the login page to steal credentials, disclose sensitive information, or initiate a Denial of Service (DoS). This flaw was originally identified in 2019, and multiple exploits can be found In-the-Wild. Eclypsium researchers created a new Proof-of-Concept (PoC) exploit that demonstrates how even unsophisticated attackers can easily exploit the vulnerability today. QCT patched the vulnerability and administrators should upgrade their infrastructure immediately. Zero-day exploits are virtually impossible to efficiently predict and can introduce substantial chaos to any affected organization. The effects of zero-day exploits are problems that are out of the control of network administrators and defenders, and the chaos stemming from those surprises, need not be exacerbated by years old known vulnerabilities. CTIX analysts urge network administrators (not just QCT products) to research the flaws that have historically impacted their infrastructure and ensure that proactive defense is an ongoing process. This will allow many problems to be solved before they ever happen, instead of adding to the turmoil of surprise zero-day vulnerabilities.