Supermicro server motherboards can be infected with unremovable malware

On 24 September 2025, Ars Technica reports that Supermicro server motherboards can be infected with unremovable malware via high‑severity vulnerabilities in baseboard management controllers (BMCs) that allow remote installation of malicious firmware running before the operating system. The flaws, tracked as CVE-2025-7937 and CVE-2025-6198, reside on silicon soldered onto the motherboards and can be triggered after attackers gain BMC administrative access, potentially enabling persistent reflashing of UEFI firmware.

One of the underlying issues stemmed from an incomplete patch for CVE-2024-10237, a vulnerability discovered by Nvidia last year, with Nvidia’s PoC showing how a malicious update could bypass firmware validation. Binarly’s founder and CEO, Matrosov, warned that even after the January 2025 patch, the same vulnerability could be exploited at another memory offset, and that attackers could distribute malicious updates via supply chains.

Supermicro has updated the BMC firmware to mitigate the vulnerabilities and is testing affected products, but the status of these updates remains unclear according to Nvidia.