Researchers uncover problems with firmware validation checks and Root of Trust.
Researchers have published details of two new flaws in Supermicro baseband management controller (BMC) firmware that hint at deeper weaknesses in the way the company currently secures this type of low-level software.
Supermicro is a leading maker of the server motherboards widely used in data centers. The BMC is a critical motherboard chip used to monitor system health independently of the OS on these systems, including when they’re powered down.
Anyone able to hijack this firmware would gain the power to control the server and gain persistence at a level below normal security software and the OS.
According to firmware security firm Binarly, the first vulnerability, CVE-2025-7937, is a weakness affecting the firmware validation logic used to secure Supermicro’s BMC firmware which was given a high-severity CVSS score of 7.2. Attackers exploiting it would be able to update the system with rogue firmware.
Significantly, Binarly discovered the issue when testing Supermicro’s fix for a similar vulnerability, CVE-2024-10237, patched by the company in January. Discovered by the Nvidia Offensive Security Research Team, that too allowed attackers to install a malicious firmware image.
In either case, “this security issue could allow potential attackers to gain complete and persistent control of both the BMC system and the main server OS,” said Binarly.
During this research, Binarly discovered a second vulnerability, CVE-2025-6198, relating to Supermicro’s X13SEM-F motherboard firmware, also rated as high severity with a CVSS score of 7.2.
While CVE-2025-7937 or CVE-2025-6198 would pose major security risks in the event attackers were able to exploit them, the caveat is that to do so the attackers would need to have established admin access to the systems to interact with the firmware.
That might make exploitation sound like a long shot — neither can be exploited remotely — but as countless real-world attacks show, rogue admin access and privilege elevation can be gained in a separate, indirect attack.
Incomplete fix
CVE-2025-7937 and CVE-2025-6198 uncovered different issues with Supermicro’s validation logic, the checking process that’s supposed to stop legitimate firmware being replaced with malicious code.
Binarly said that the January flaw, CVE-2024-10237, made it possible to fool the validation process by adding illicit entries to the firmware map table (fwmap) so that the rogue firmware matched the cryptographically signed value.
Supermicro adjusted the validation checks to detect this, but through CVE-2025-7937, Binarly researchers were able to re-target the modified validation checking.
Encouraged, Binarly then decided to take a closer look at the way the Supermicro validation process implements Root of Trust (RoT), using the X13SEM-F motherboard as the test bed. It turns out that this function relies on a sig_table that is part of the new firmware file. This lists the manifest of the firmware regions used to calculate the cryptographic hash.
This leads to CVE-2025-6198: “It is possible to modify it [the sig_table], along with some other parts of the image — for example, the kernel — and move the original data to unused space in the firmware. This means that the signed data digest will still match the original value,” said Binarly.
Mitigation
Binarly’s advice is to adopt careful source verification and integrity checks for firmware images, patch as soon as new issues appear, and enable RoT security where hardware supports it.
Beyond that, it is a matter of continuous monitoring and security audits. The problem, as ever, is that many organizations might be tempted to skip this when they have so many other security issues to worry about.
In short, there’s no simple way to stop firmware manipulation; the important qualifier is that documented attacks successfully hijacking firmware at this level are rare.
One exception to this was CVE-2024-54085 from June, an authentication spoofing vulnerability in AMI MegaRAC SPx server management firmware which CISA warned was under active exploitation.
However, unexploited vulnerabilities abound. For example, in April, AMI patched a vulnerability affecting the MegaRAC BMC firmware used in numerous enterprise servers and storage systems, and in 2022, security vendor Eclypsium found that the BMCs of thousands of HPE iLO (HPE’s Integrated Lights-Out) servers were running vulnerable firmware.
