Supermicro MBD-X12SPI CVE-2026-18451

Exploitation requires the affected product's HTML5 KVM-over-IP console feature (served by the BMC/IPMI web interface on the Supermicro MBD-X12SPI, firmware 01.07.20) to be reachable and in use, and depends on the weak token-generation scheme (CWE-337) that lets an attacker guess the session token the web interface issues. Per the CVSS vector it is network-reachable and unauthenticated (AV:N/PR:N) but LIMITED by high attack complexity (AC:H - the attacker must successfully guess/predict the token) and required user interaction (UI:R - a legitimate KVM session must be active to hijack). The dominant real-world limiting factor is deployment: BMC management interfaces are normally on an isolated management LAN and not internet-exposed, which sharply narrows the attack surface.

Signals are consistent and point to a LOW real-world priority. The vendor-supplied CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) yields a base score of only 3.1: network-reachable and unauthenticated (PR:N), but gated by high attack complexity (AC:H, reflecting that the session token must be successfully guessed) and required user interaction (UI:R, implying a legitimate KVM session must be active). EPSS reinforces this at 0.15% (4th percentile), and the vuln.today Decision label is 'monitor' - not act_now or emergency. The CVE is NOT in CISA KEV and no public exploit or PoC reference is present in the input, so there is no public exploit identified at time of analysis. The main conflict is impact scoping: the description says an attacker can 'take control of the KVM session,' which realistically grants full keyboard/video/mouse access to the server console (high confidentiality and integrity), yet the vendor vector records only C:L/I:N/A:N - this understates impact and should be verified with Supermicro. Net: a genuine design weakness (CWE-337, weak token generation) but, given AC:H, UI:R, low EPSS, no KEV and no PoC, this is a monitor-tier issue rather than an urgent one - provided the BMC management network is not internet-exposed.

An attacker with network reach to the Supermicro BMC's HTML5 KVM-over-IP web interface waits for or induces an active console session, then exploits the weak token-generation scheme (CWE-337) to predict the valid session token and hijack the live KVM session, gaining view of and input control over the server console. High attack complexity (AC:H) and the need for an active victim session (UI:R) make this non-trivial, and no public exploit code is identified at time of analysis.