EUVD-2026-47615
GHSA-cjff-5v28-x7h8
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable SMASH service, low complexity, requires a valid low-privilege management account (PR:L), no UI; command injection on the BMC yields full C/I/A impact within the same component (S:U).
Primary rating from Vendor (Supermicro).
CVSS VectorVendor: Supermicro
Lifecycle Timeline
2DescriptionCVE.org
Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI. An authorized attacker can exploit SMASH’s input capability to compromise data integrity or launch a Denial-of-Service (DoS) attack against the BMC.
AnalysisAI
OS command injection in the SMASH (Systems Management Architecture for Server Hardware) service of Supermicro X14DBG-DAP and X14DBI platforms lets an authenticated attacker inject operating-system commands through SMASH's input handling on the Baseboard Management Controller (BMC). Successful exploitation yields arbitrary code execution on the BMC, enabling data-integrity tampering or a denial-of-service of the management controller. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.
Technical ContextAI
The affected component is the BMC firmware's SMASH interface, a DMTF-standard command-line management protocol (typically reachable over SSH/Telnet on the out-of-band management network) used to administer server hardware independently of the host OS. The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command), meaning user-supplied SMASH input is passed to an underlying shell or system call without adequate sanitization, allowing shell metacharacters to break out into arbitrary command execution in the BMC's embedded Linux context. The CPE cpe:2.3:a:smci:x14dbg-dap,x14dbi identifies the affected products as Supermicro's X14-generation X14DBG-DAP and X14DBI motherboards/platforms; because the BMC runs with high privilege and sits below the host OS trust boundary, code execution there is effectively a full compromise of the management plane.
RemediationAI
Apply the fixed BMC/IPMI firmware for the X14DBG-DAP and X14DBI platforms per Supermicro's July 2026 advisory (https://www.supermicro.com/en/support/security_BMC_IPMI_Jul_2026); an exact fixed firmware version is not stated in the provided data, so treat patch status as 'Patch available per vendor advisory' and obtain the precise build from that page. As compensating controls until firmware is applied, isolate BMC management interfaces onto a dedicated, physically or logically segmented management VLAN and block SMASH/SSH/Telnet/IPMI ports (e.g., TCP 22/23, UDP 623) from user and internet-facing networks (trade-off: remote out-of-band administration must then traverse a bastion/jump host); enforce strong, unique BMC credentials and remove or restrict low-privilege management accounts since exploitation requires only PR:L (trade-off: tighter account hygiene may disrupt shared operational access); and disable the SMASH/CLI service if it is not operationally required (trade-off: loss of standards-based command-line management).
Same weakness CWE-78 – OS Command Injection
View allShare
External POC / Exploit Code
Leaving vuln.today