Supermicro MBD-X12SPI EUVD-2026-110638

Requires valid IPMI Administrator credentials on the Supermicro MBD-X12SPI BMC (PR:H) and network reachability to the BMC's IPMI management interface (AV:N); no user interaction is needed. Exploitation is limited by that administrator-privilege requirement and, in well-segmented environments, by BMC/IPMI interfaces being isolated on a dedicated out-of-band management VLAN rather than the general network - deployments that expose IPMI broadly or retain default/shared BMC credentials are at materially higher risk. The specific feature or IPMI command that exposes arbitrary physical memory read/write is not described in the available sources.

Signals are consistent and point to a moderate, authentication-gated risk rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N, score 7.2 High) indicates a network-reachable, low-complexity attack but one that requires PR:H - i.e. valid IPMI Administrator credentials - so this is a post-authentication privilege-to-code-execution flaw, not an unauthenticated breach. EPSS is low (0.32%, 24th percentile), which aligns with the absence of any exploitation signal: the input shows no CISA KEV listing and no PoC/exploit reference, so the exploitation status is 'no public exploit identified at time of analysis.' The vuln.today priority is 'this_week,' which is elevated but below act_now/emergency, consistent with the low EPSS and no-KEV picture. The main tension is between the High CVSS and the strong mitigating gate (administrator-level access already needed): the real-world danger is concentrated in the impact - an administrator who can read/write arbitrary BMC physical memory gains code execution on the BMC OS, giving stealthy, below-the-OS persistence on the host - rather than in ease of initial access. Note also that the CWE-287 (Improper Authentication) classification and the 'Authentication Bypass' tag sit awkwardly with a description that explicitly requires an already-authenticated IPMI Administrator; this looks like a privilege/memory-access issue for an authenticated role, not a true auth bypass - verify the exact mechanism with the Supermicro advisory.

An attacker who has obtained IPMI Administrator credentials (via credential reuse, default/weak BMC passwords, or a compromised management workstation) connects to the BMC's IPMI interface over the network and issues the privileged operation to read and write arbitrary BMC physical memory. By overwriting BMC memory the attacker executes arbitrary code on the BMC operating system, establishing firmware-level control of the server that survives host OS reinstalls. No public exploit code or PoC is identified in the available data, and exploitation requires administrator-level IPMI access.