PT-2022-5773 · Ami · Megarac

Vlad Babkin · Published 2022-12-05 · Updated 2023-07-21 · CVE-2022-40259

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MegaRAC (affected versions not specified)

Description The issue is related to errors in code generation in the AMI MegaRAC Redfish API interface, which can be exploited by a remote attacker to execute arbitrary code by sending a specially crafted HTTP request.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Improper Authentication

Code Injection

Weakness Enumeration

CWE-798

CWE-287

CWE-94

CWE-250

Related Identifiers

BDU:2022-07173

CVE-2022-40259

Affected Products

Megarac

References · 15

• https://9443417.fs1.hubspotusercontent-na1.net/hubfs/9443417/Security%20Advisories/AMI-SA-2023001.pdf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-40259 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40259 · Security Note
• https://bdu.fstec.ru/vul/2022-07173 · Security Note
• https://t.me/true_secator/3789 · Telegram Post
• https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf04385en_us · Note
• https://t.me/cvenotify/43206 · Telegram Post
• https://eclypsium.com/2022/12/05/supply-chain-vulnerabilities-put-server-ecosystem-at-risk · Note
• https://support.lenovo.com/us/en/product_security/LEN-98711 · Note
• https://t.me/true_secator/4644 · Telegram Post
• https://support.hpe.com/hpesc/public/docDisplay?docLocale=en_US&docId=hpesbhf04385en_us · Note
• https://t.me/cibsecurity/54039 · Telegram Post
• https://t.me/cvenotify/39280 · Telegram Post
• https://t.me/echeloneyes/939 · Telegram Post
• https://gigabyte.com/Support/Security/2044 · Note