CVE-2020-26122

CVE-2020-26122 describes a remote code execution vulnerability affecting Inspur NF5266M5 servers (through version 3.21.2) and other M5 series devices. The vulnerability stems from insufficient firmware verification and a lack of signature validation within the Baseboard Management Controller (BMC) program. An attacker with administrator privileges can exploit this weakness to insert malicious code into the firmware, bypass existing verification, and gain control of the BMC. This high-severity vulnerability (CVSS 7.2) allows for complete compromise of confidentiality, integrity, and availability, with a low attack complexity. While no public exploits or active exploitation have been observed, and community discussion is minimal, the potential impact remains significant for affected systems.