CVE-2023-34330: high-severity vulnerability in AMI MegaRAC_SPx12
Code injection via Dynamic Redfish Extension interface
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A flaw in AMI SPx's BMC allows attackers to inject and execute malicious code through the Dynamic Redfish Extension interface, potentially compromising the security of the entire system.
CWE-94 code injection vulnerability in AMI SPx BMC's Dynamic Redfish Extension interface permits unauthenticated or low-privileged users to inject arbitrary code that achieves remote execution. Successful exploitation results in complete compromise of confidentiality, integrity, and availability of the affected BMC and potentially the managed system.
In the same product, most dangerous first.