"Unfixable 6-Year-Old BMC Flaw Haunts Intel and Lenovo Servers"

A 6-year-old vulnerability in the Lighttpd web server used in Baseboard Management Controllers (BMC) has been overlooked by vendors like Intel and Lenovo, leading to the exfiltration of process memory addresses and potential bypassing of protection mechanisms. The vulnerability, silently patched in 2018, was missed by developers and has impacted a large number of devices, including those from Intel and Lenovo. Despite being notified, impacted models have reached end-of-life and will likely remain vulnerable indefinitely due to the lack of patches, highlighting gaps in the firmware supply chain and the need for greater transparency and awareness.