CVE-2019-6260

The ASPEED ast2400 and ast2500 Baseband Management Controller (BMC) hardware and firmware implement Advanced High-performance Bus (AHB) bridges, which allow arbitrary read and write access to the BMC's physical address space from the host (or from the network in unusual cases where the BMC console uart is attached to a serial concentrator). This CVE applies to the specific cases of iLPC2AHB bridge Pt I, iLPC2AHB bridge Pt II, PCIe VGA P2A bridge, DMA from/to arbitrary BMC memory via X-DMA, UART-based SoC Debug interface, LPC2AHB bridge, PCIe BMC P2A bridge, and Watchdog setup.

• https://security.netapp.com/advisory/ntap-20190314-0001/Patch, Third Party Advisory
• https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-785Third Party Advisory
• https://www.flamingspork.com/blog/2019/01/23/cve-2019-6260:-gaining-control-of-bmc-from-the-host-processor/Third Party Advisory
• https://security.netapp.com/advisory/ntap-20190314-0001/Patch, Third Party Advisory
• https://www.broadcom.com/support/fibre-channel-networking/security-advisories/brocade-security-advisory-2019-785Third Party Advisory
• https://www.flamingspork.com/blog/2019/01/23/cve-2019-6260:-gaining-control-of-bmc-from-the-host-processor/Third Party Advisory

Published

Jan 22, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-6250A pointer overflow, with code execution, was discovered in Z…
• CVE-2019-6251WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnera…
• CVE-2019-6256A Denial of Service issue was discovered in the LIVE555 Stre…
• CVE-2019-6257A Server Side Request Forgery (SSRF) vulnerability in elFind…7.7
• CVE-2019-6258D-Link DIR-822 Rev.Bx devices with firmware v.202KRb06 and o…9.8
• CVE-2019-6259An issue was discovered in idreamsoft iCMS V7.0.13. There is…
• CVE-2019-6261An issue was discovered in Joomla! before 3.9.2. Inadequate …
• CVE-2019-6262An issue was discovered in Joomla! before 3.9.2. Inadequate …
• CVE-2019-6263An issue was discovered in Joomla! before 3.9.2. Inadequate …
• CVE-2019-6264An issue was discovered in Joomla! before 3.9.2. Inadequate …
• CVE-2019-6265The Scripting and AutoUpdate functionality in Cordaware best…
• CVE-2019-6266Cordaware bestinformed Microsoft Windows client before 6.2.1…