AMI MegaRAC SPx (SPX REST API): Arbitrary read and write into the memory of the BMC's IPMI server process via the SPX

Impact

Arbitrary read and write into the memory of the BMC's IPMI server process via the SPX REST API. That is a full primitive - the attacker reads out credentials, session tokens and keys held in that process, then writes to redirect execution. In fleet terms, one compromised BMC admin credential turns into code execution on the controller and from there into persistent firmware-level control of the node.

Who can reach it

Network-reachable REST API, requires high privileges - an administrative BMC account. The realistic path is credential reuse: fleets provision BMCs from a template and end up with the same admin password across an entire rack or SKU, so a single leaked credential from one node's config, a Redfish scraper, or a decommissioned host escalates to every node sharing it.

What to do

Firmware flash to SPx_12.7 / SPx_13.5, out-of-band per node, ODM-gated. The higher-leverage work is credential hygiene and is config-only: unique per-node BMC admin passwords generated and stored by your secrets manager, no admin credential embedded in provisioning images or monitoring configs, and Redfish accounts scoped to read-only where they only scrape telemetry.

References