Two New Supermicro BMC Bugs Allow Malicious Firmware to Evade Root of Trust Security

Cybersecurity researchers have disclosed two medium-severity vulnerabilities (CVE-2025-7937, CVE-2025-6198) in Supermicro Baseboard Management Controller (BMC) firmware, enabling attackers to bypass cryptographic signature verification during firmware updates. This allows for the installation of malicious firmware, granting complete and persistent control over both the BMC and the main server OS, and critically, bypassing the BMC's Root of Trust. The findings highlight insufficient vendor patching, as one vulnerability circumvents a prior fix, and the broader concern over reused signing keys across Supermicro products presents a significant supply chain security risk for institutional deployments.

Analysis

Two medium-severity vulnerabilities (CVE-2025-7937 and CVE-2025-6198) have been disclosed in Supermicro (SMCI) Baseboard Management Controller (BMC) firmware, which could allow an attacker to install a malicious image and gain persistent control over the server. Critically, one vulnerability (CVE-2025-6198) bypasses the hardware Root of Trust (RoT), a foundational security feature, contradicting previous assurances from Supermicro's security team. The other flaw (CVE-2025-7937) circumvents a patch for a previous vulnerability (CVE-2024-10237), raising questions about the efficacy of the company's remediation processes. The research further highlights a significant systemic risk stemming from Supermicro's practice of reusing cryptographic signing keys across product lines. This practice, if a key were to be leaked, could have an industry-wide impact, creating a material supply chain security risk for institutional customers heavily reliant on Supermicro hardware.

Key Decisions for Investors

• Investors should treat these recurring firmware vulnerabilities in Supermicro (SMCI) as a material risk, as the bypassing of the hardware Root of Trust and the ineffectiveness of prior patches could erode customer trust and impact future sales in security-sensitive enterprise markets.
• It is prudent to monitor Supermicro's response and remediation plan closely, as the identified systemic risk from reused signing keys presents a significant, long-tail threat to the company's reputation and product security posture.
• Consider the potential for a negative impact on SMCI's competitive positioning, as these disclosures may drive customers toward rivals perceived to have more robust hardware security and transparent vulnerability management.