PT-2020-16301 · Inspur · Inspur Nf5266M5

Published 2020-12-07 · Updated 2020-12-08 · CVE-2020-26122

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Inspur NF5266M5 versions 3.21.2 and earlier

Description The Baseboard Management Controller (BMC) program of INSPUR server is weak in checking the firmware and lacks the signature verification mechanism. An attacker who obtains administrator's rights can control the BMC by inserting malicious code into the firmware program and bypassing the current verification mechanism to upgrade the BMC, allowing remote code execution via administrator privileges.

Recommendations For Inspur NF5266M5 versions 3.21.2 and earlier, consider disabling the BMC program until a patch is available to prevent remote code execution. Restrict access to the BMC to minimize the risk of exploitation. Avoid using the administrator privileges for the BMC until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Verification of Cryptographic Signature

Weakness Enumeration

CWE-347

Related Identifiers

CVE-2020-26122

Affected Products

Inspur Nf5266M5

References · 6

• https://osv.dev/vulnerability/CVE-2020-26122 · Vendor Advisory
• https://en.inspur.com/en/security_bulletins/security_advisory2/2543921/index.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26122 · Security Note
• https://t.me/cibsecurity/17191 · Telegram Post
• https://en.inspur.com/en/2487134/index.html · Note
• https://t.me/cvenotify/6695 · Telegram Post