Supermicro MBD-X12SPI EUVD-2026-110639

Exploitation requires the attacker to already hold IPMI administrator-level credentials on the affected BMC - the description explicitly scopes this to 'an IPMI authenticated administrator.' The product condition is a Supermicro MBD-X12SPI board running BMC/IPMI firmware version 01.07.20. No user interaction is needed (UI:N) and the BMC IPMI interface is reachable over the network (AV:N). The principal limiting factor is the administrative authentication prerequisite (PR:H): this is a privilege-escalation path from BMC administrator to OS root on the BMC, not an unauthenticated takeover, so realistic risk depends on how well IPMI admin credentials and management-network access are controlled. The specific administrative feature or parameter that accepts the injected command is not described in the available sources.

This is a moderate, not emergency-level, priority and the signals are broadly consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N, C:H/I:H/A:H, base 6.6) describes a network-reachable but high-privilege flaw: the attacker must already be an authenticated IPMI administrator (PR:H), which sharply narrows the realistic attacker population to insiders or whoever has already captured BMC admin credentials. EPSS is low at 0.54% (45th percentile), there is no CISA KEV listing, and no public exploit is referenced, so there is no evidence of active or widespread exploitation. The vuln.today decision label is 'this_month' - remediate on a normal patch cadence, not as an emergency. One inconsistency worth flagging: the source vector sets AC:H, but the description ('an IPMI authenticated administrator to execute commands as the operating system root user') does not explain any high-complexity trigger condition such as a race or timing requirement - the trigger mechanism is not described in the available sources, so the AC:H rating cannot be corroborated and should be verified with Supermicro. Net: a genuine privilege-escalation issue (BMC admin → OS root on the BMC) that matters for defense-in-depth on affected boards, but the high privilege prerequisite keeps real-world risk below what the CWE-78 command-injection class alone might suggest.

An attacker who has already obtained (or been granted) IPMI administrator credentials on a Supermicro X12SPI BMC connects over the network and abuses an administrative function to inject an operating-system command that runs as root on the BMC. This converts limited BMC administrative access into full root control of the baseboard management controller. No public exploit code is identified at time of analysis.