X11Dai N Firmware
CVE-2019-16650
CRITICAL
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
1DescriptionNVD
On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number. In opportunistic circumstances, an attacker can simply connect to the virtual media service, and then connect virtual USB devices to the server managed by the BMC.
AnalysisAI
On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Technical ContextAI
On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number. In opportunistic circumstances, an attacker can simply connect to the virtual media service, and then connect virtual USB devices to the server managed by the BMC. Affected products include: Supermicro X11Dai-N Firmware, Supermicro X11Dac Firmware, Supermicro X11Dph-Tq Firmware, Supermicro X11Dph-I Firmware, Supermicro X11Dph-T Firmware.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.
More in X11Dai N Firmware
View allOn Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the v
The web interface in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implemen
The configuration functionality in the Intelligent Platform Management Interface (IPMI) baseboard management controller
Buffer Overflow vulnerability in Supermicro motherboard X12DPG-QR 1.4b allows local attackers to hijack control flow via
A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementatio
Supermicro X11SSL-CF HW Rev 1.01, BMC firmware v1.63 was discovered to contain insecure permissions. Rated medium severi
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today