Intel and Lenovo servers impacted by 6-year-old BMC flaw

Binarly researchers discovered a remotely exploitable heap out-of-bounds read in Lighttpd used in BMC firmware (pre-1.4.51) that can leak process memory and facilitate ASLR bypass; an upstream fix from 2018 was silently patched without a CVE and was not integrated by some vendors (notably AMI MegaRAC), causing thousands of Intel, Lenovo, and other vendor devices — many now EOL — to remain vulnerable and publicly exposed.