Intel and Lenovo BMCs Contain Unpatched Lighttpd Server Flaw

Binarly disclosed an out‑of‑bounds read vulnerability in older Lighttpd versions embedded in BMC firmware (notably Intel M70KLP series and Lenovo BMC builds). Although the bug was silently fixed upstream in Lighttpd 1.4.51 (August 2018), the absence of a CVE/advisory and vendor EoL decisions left affected devices unpatched, allowing potential memory disclosure that could aid ASLR bypass and long-term supply-chain risk.