> This is an interesting attack surface. Can you extend the risk out a bit? Assume that you have a vulnerable supermicro IPMI now exposed on a public interface.

> This is an interesting attack surface. Can you extend the risk out a bit? Assume that you have a vulnerable supermicro IPMI now exposed on a public interface. It has no IP address, and is presumably issuing DHCP DISCOVERs in an effort to get an IP. How do you reach the IPMI device to exploit it? What additional access do you need to get there? I think you misunderstood the level of fucked up this really was. The BMC device sits on the north bridge and literally scoops up packets from the main NIC which means it can even be accessible from the internets (if you didn't firewall port 623). See [0] for an example how variation of this unfolded. [0] - https://www.zdnet.com/article/over-47000-supermicro-servers-are-exposing-bmc-ports-on-the-internet/ https://www.zdnet.com/article/over-47000-supermicro-servers-...