Supermicro server motherboards can be infected with unremovable malware

Binarly has identified critical, high-severity vulnerabilities (CVE-2025-7937, CVE-2025-6198) in Supermicro server motherboards, including those deployed in AI data centers, which allow remote installation of malicious firmware that executes before the operating system. These flaws, one resulting from an incomplete Supermicro patch, offer "unprecedented persistence" and could enable undetectable data destruction akin to ILObleed attacks, presenting substantial security and operational risks for institutional investors and organizations reliant on Supermicro infrastructure.

Analysis

Supermicro (SMCI) is exposed to significant reputational and operational risk following the discovery of two high-severity vulnerabilities (CVE-2025-7937, CVE-2025-6198) in its server motherboard Baseboard Management Controllers (BMCs). These vulnerabilities allow for the remote installation of malicious firmware that executes before the operating system, creating what security researchers call "unprecedented persistence" that is extremely difficult to detect or remove. The direct impact on fleets within AI data centers is particularly concerning, as it threatens the core of SMCI's recent growth narrative. The situation is exacerbated by the fact that one vulnerability resulted from an "incomplete patch" for a prior issue, raising fundamental questions about the company's security engineering quality and response protocols. The comparison to the destructive ILObleed wiper attacks highlights the potential for severe customer data loss, which could lead to a loss of trust and a flight-to-quality among enterprise clients.

Key Decisions for Investors

• Investors should immediately assess the potential for a sharp negative impact on SMCI's stock price, as the news directly threatens its reputation as a reliable supplier for mission-critical AI infrastructure.
• Monitor Supermicro's official response, including the timeline and efficacy of forthcoming patches, as a slow or inadequate reaction could lead to customer defections and material revenue impact.
• Consider the potential for market share shifts to competitors, as this incident may cause enterprise and data center clients to re-evaluate their hardware suppliers based on security robustness.
• The revelation of an 'incomplete patch' introduces a qualitative risk regarding SMCI's internal controls and technical diligence, which may warrant a higher risk premium on the stock until these concerns are demonstrably resolved.