PATCH BYPASSED FOR SUPERMICRO VULNERABILITY ALLOWING BMC HACK

Summary from the TLDR InfoSec newsletter

Binarly researchers found they could bypass Supermicro's patch for CVE-2024-10237, a firmware flaw allowing malicious updates, prompting a new CVE (CVE-2025-7937) and fix. They also discovered CVE-2025-6198, a flaw that bypasses the Root of Trust. Both enable attackers to control the BMC and OS. These flaws show firmware validation's fragility, risking persistent BMC code execution with major enterprise security implications.