"Quanta Servers Caught With 'Pantsdown' BMC Vulnerability"

A critical firmware vulnerability has been discovered in several popular Quanta Cloud Technology (QCT) server models that power hyperscale data center operations and cloud provider infrastructure. The vulnerability puts them at risk of attacks that gain complete control of the server and can spread across multiple servers on the same network. According to new research published by Eclypsium, the QCT models are vulnerable to the "Pantsdown" vulnerability (CVE-2019-6260), a flaw found in 2019 that affects Baseboard Management Controller (BMC) technology on many firmware stacks used in modern servers. BMCs are minicomputers housed within servers that include their own power supply, firmware, memory, and networking stack. They enable remote administrators to control the server to manage low-level hardware settings, update host operating systems, and manage virtual hosts, applications, or data on the system. Servers are often managed through BMCs using Intelligent Platform Management Interface (IPMI) controlled groups that share the same password, making it easier to move across systems once one BMC is compromised. That type of privilege makes BMCs attractive targets for attackers when flaws like these emerge. This article continues to discuss the Pantsdown BMC vulnerability present in QCT servers. 

Dark Reading reports "Quanta Servers Caught With 'Pantsdown' BMC Vulnerability"