Ethical Hacking News
New Security Vulnerabilities Discovered in Supermicro BMC Firmware: A Threat to Root of Trust Security
Recent security research has revealed two new vulnerabilities in the Supermicro Baseboard Management Controller (BMC) firmware that can potentially allow attackers to bypass the critical Root of Trust (RoT) security feature. These medium-severity vulnerabilities, identified as CVE-2025-7937 and CVE-2025-6198, stem from improper verification of a cryptographic signature in the BMC firmware. The discovery highlights the importance of staying informed about potential security threats and vulnerabilities in the industry.
Supermicro's server and storage systems have been hit with two new security vulnerabilities (CVE-2025-7937 and CVE-2025-6198) that can bypass the Root of Trust (RoT) security feature. The vulnerabilities stem from improper verification of a cryptographic signature in the Baseboard Management Controller (BMC) firmware. CVE-2025-7937 allows attackers to redirect the program to a fake "fwmap" table, while CVE-2025-6198 allows attackers to redirect the program to a fake signing table ("sig_table") System administrators are recommended to update their Supermicro BMC firmware to the latest version and implement additional security measures. Organizations should stay informed about potential security threats and vulnerabilities by following reputable cybersecurity news platforms and websites.
Supermicro, a leading manufacturer of server and storage systems, has recently been hit by two new security vulnerabilities that can potentially allow attackers to bypass the critical Root of Trust (RoT) security feature. These medium-severity vulnerabilities, identified as CVE-2025-7937 and CVE-2025-6198, stem from improper verification of a cryptographic signature in the Baseboard Management Controller (BMC) firmware.
According to cybersecurity researchers at Binarly, who discovered and reported these shortcomings, the first vulnerability, CVE-2025-7937, allows attackers to bypass the BMC's Root of Trust 1.0 by redirecting the program to a fake "fwmap" table in the unsigned region of the firmware image. This can be achieved by crafting a malicious firmware image that exploits a logical flaw in the validation process of the uploaded firmware.
On the other hand, CVE-2025-6198 allows attackers to bypass the BMC's Root of Trust security feature by redirecting the program to a fake signing table ("sig_table") in the unsigned region. This vulnerability demonstrates that even if an attacker gains control over the BMC system, they can still update the firmware with a specially crafted image.
Firmware security company Binarly has been credited with discovering and reporting these vulnerabilities. The researchers have analyzed the implementation of the firmware validation logic in the X13SEM-F motherboard and found a flaw within the "auth_bmc_sig" function that could permit an attacker to load a malicious image without modifying the hash digest value.
The image validation process carried out during a firmware update takes place over three steps: Retrieve the public key from the BMC SPI flash chip, process the "fwmap" or "sig_table" table embedded in the uploaded image, and compute a cryptographic hash digest of all "signed" firmware regions, and verify the signature value against the calculated hash digest.
According to Binarly researcher Anton Ivanov, this security issue could allow potential attackers to gain complete and persistent control of both the BMC system and the main server OS. The vulnerability was originally discovered by NVIDIA, alongside CVE-2024-10237, CVE-2024-10238, and CVE-2024-10239.
In an interview with The Hacker News, Alex Matrosov, CEO and Head of REsearch at Binarly, stated that the previous statement from Supermicro regarding the hardware RoT (Root of Trust) authenticating the key is not accurate. "However, new research shows that the previous statement is not accurate, and CVE-2025-6198 bypasses the BMC RoT," Matrosov said.
"Previously, we reported the discovery of the test key on Supermicro devices, and their PSIRT doubled down that the hardware RoT (Root of Trust) authenticates the key and has no impact on this discovery," he added. "However, new research shows that the previous statement from Supermicro is not accurate, and CVE-2025-6198 bypasses the BMC RoT. In this case, any leak of the signing key will impact the entire ecosystem. Reusing the signing keys per product line is not the best approach."
In order to avoid being affected by these vulnerabilities, it is recommended that system administrators update their Supermicro BMC firmware to the latest version and implement additional security measures such as rotating signing keys and ensuring proper validation of the firmware image.
Furthermore, it is also essential for organizations to stay informed about potential security threats and vulnerabilities in the industry. This can be achieved by following reputable cybersecurity news platforms and websites, such as The Hacker News, which provide regular updates on newly discovered vulnerabilities and security breaches.
Related Information:
https://www.ethicalhackingnews.com/articles/New-Security-Vulnerabilities-Discovered-in-Supermicro-BMC-Firmware-A-Threat-to-Root-of-Trust-Security-ehn.shtml
https://thehackernews.com/2025/09/two-new-supermicro-bmc-bugs-allow.html
https://nvd.nist.gov/vuln/detail/CVE-2025-7937
https://www.cvedetails.com/cve/CVE-2025-7937/
https://nvd.nist.gov/vuln/detail/CVE-2025-6198
https://www.cvedetails.com/cve/CVE-2025-6198/
Published: Tue Sep 23 15:54:17 2025 by llama3.2 3B Q4_K_M
