spx_restservice SubNet_handler_func Multiple Command Injections and Stack-Based Buffer Overflows

Vulnerability

The vulnerability resides in the SubNet_handler_func function of spx_restservice, a component of the AMI MegaRAC SP-X based BMC firmware. Improper input validation leads to multiple command injections and stack-based buffer overflows. Affects Lanner IAC-AST2500A standard firmware version 1.10.0 [1][2]. The code path is reachable over the network without authentication.

Exploitation

An unauthenticated remote attacker can send crafted network requests to the spx_restservice endpoint. By manipulating input parameters, the attacker can trigger command injection or stack buffer overflow, achieving arbitrary code execution. No user interaction is required [1][2].

Impact

Successful exploitation results in arbitrary code execution with root privileges on the BMC. This compromises the entire BMC, potentially allowing the attacker to also compromise the managed host [1][2].

Mitigation

Lanner provides updated BMC firmware versions that fix the issue; contact Lanner technical support for the updated firmware [2]. No workaround is disclosed. The CVE is not listed in the CISA Known Exploited Vulnerabilities Catalog.