Patch Bypassed for Supermicro Vulnerability Allowing BMC Hack

Binarly researchers have found a way to bypass a patch for a Supermicro vulnerability that could enable malicious firmware updates to the BMC. According to Binarly, the patch released by Supermicro could be bypassed, and as a result the vendor assigned a new CVE identifier, CVE-2025-7937, with another patch attempt in September 2025. The researchers also identified a second vulnerability, CVE-2025-6198, which can be exploited to deploy a malicious firmware image and to bypass the RoT security feature.

Supermicro has patched both flaws, and there is no evidence of in-the-wild exploitation for either. According to CISA, AMI BMC flaws exploited in attacks have been warned about previously, underscoring the persistent risk to enterprise environments when firmware validation is fragile. Written by Eduard Kovacs, the piece notes that successful exploits grant persistent code execution at the BMC level and control of both the BMC and the main OS.