CVSS 10 bug in baseboard firmware exploited in the wild - that's a klaxon for CISOs

Vulnerability in ubiquitous remote server management firmware from AMI affects Asus, ASRock, Blackcore, HPE, Gigabyte, NetApp, Lenovo, Siemens servers; more.

By Edward Targett

Updated Jun 29, 2025 5:54 PM / Published Jun 29, 2025 4:02 PM 4 min read

AMI vulnerability baseboard management controller security — A Lenovo ThinkStation BMC that utilises the MegaRAC SP-X.

A CVSS 10 Baseboard Management Controller (BMC) vulnerability has been confirmed as exploited in the wild by CISA – a troubling first for the industry and a klaxon for CISOs who face potential deep persistence.

The exploited BMC firmware from AMI is built into countless motherboards to remotely manage servers. The vulnerability is a pre-auth RCE bug that, astonishingly, lets a remote attacker create a new administrator-level user with no credential checks via a simple API call.

This content is for members only

Already have an account? Sign in

Add The Stack on Google

Edward Targett

Ed is a co-founder of The Stack. He previously edited Computer Business Review. He has also covered energy markets. He started his journalism career on local papers. He left school at 15 and has made a living asking "but why?" ever since.