CVE-2020-26122

HIGH

Inspur M5 Server Firmware - Remote Code Execution via BMC Firmware Signature Verification Bypass

Title source: llm
STIX 2.1

Description

Inspur NF5266M5 through 3.21.2 and other server M5 devices allow remote code execution via administrator privileges. The Baseboard Management Controller (BMC) program of INSPUR server is weak in checking the firmware and lacks the signature verification mechanism, the attacker who obtains the administrator's rights can control the BMC by inserting malicious code into the firmware program and bypassing the current verification mechanism to upgrade the BMC.

References (2)

Core 2
Core References
Broken Link x_refsource_misc
https://en.inspur.com/en/2487134/index.html

Scores

CVSS v3 7.2
EPSS 0.0116
EPSS Percentile 63.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-347
Status published
Products (15)
inspur/nf5180m5_firmware < 4.18.2
inspur/nf5260m5_firmware < 3.8.0
inspur/nf5266m5_firmware < 3.21.3
inspur/nf5270m5_firmware < 4.9.1
inspur/nf5280m5_firmware < 4.26.6
inspur/nf5466m5_firmware < 4.28.0
inspur/nf5468m5_firmware < 1.18.51
inspur/nf5486m5_firmware < 3.22.0
inspur/nf5488m5-d_firmware < 1.18.51
inspur/nf8260m5_firmware < 1.19.34
... and 5 more
Published Dec 07, 2020
Tracked Since Feb 18, 2026