Mbd X12Spi
Monthly
Authenticated IPMI administrators on Supermicro MBD-X12SPI BMC firmware 01.07.20 can read and write arbitrary physical memory, leading to code execution on the BMC operating system. The issue is rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and classified CWE-287; exploitation requires valid IPMI Administrator credentials and network access to the BMC management interface. No public exploit code has been identified at time of analysis, EPSS is 0.32% (24th percentile), and the vuln.today priority is this_week, so this is a moderate, authentication-gated risk rather than an emergency.
Unauthenticated remote attackers can establish an RMCP+ session on Supermicro MBD-X12SPI baseboard management controllers running BMC firmware 1.07.20 by sending a request immediately followed by a specially crafted RAKP message, abusing incorrect ordering in the RAKP+ authentication handshake; a session established this way could then be used to execute commands. The flaw is rated CVSS 7.4 (AV:N/AC:H/PR:N/UI:N, high confidentiality and integrity impact, no availability impact) and requires network reachability to the BMC's RMCP+/IPMI 2.0 interface, typically UDP 623. EPSS is 0.45% (39th percentile), the CVE is not listed in CISA KEV and no public exploit has been identified at time of analysis; this is a genuine but second-tier priority rather than a drop-everything emergency.
Command injection in Supermicro MBD-X12SPI BMC/IPMI firmware 01.07.20 allows a holder of IPMI administrator credentials to execute arbitrary commands as the operating system root user on the BMC. The flaw is reachable over the network without user interaction, but exploitation requires prior administrative access to the IPMI interface, making it a privilege-escalation path from BMC admin to OS root rather than an unauthenticated takeover. No public exploit code or active exploitation is confirmed at time of analysis, and EPSS is 0.54% (45th percentile), indicating low predicted exploitation activity.
Predictable session-token generation in the HTML5 KVM-over-IP console of the Supermicro MBD-X12SPI BMC/IPMI web interface (firmware 01.07.20) allows a remote attacker to guess a token issued by the web interface and hijack an active KVM session, gaining access to the console's display and input path. Per the assessed vector the flaw is network-reachable and unauthenticated (AV:N/PR:N), but exploitation is constrained by high attack complexity (the token must actually be guessed or predicted) and by the requirement that a legitimate KVM session already be in use (UI:R). It is not listed in CISA KEV, no public exploit code has been identified at time of analysis, and EPSS is 0.15% (4th percentile), consistent with a 'monitor' decision label and low real-world priority; the dominant limiting factor remains deployment, since BMC management interfaces are normally confined to an isolated management LAN.
Authenticated IPMI administrators on Supermicro MBD-X12SPI BMC firmware 01.07.20 can read and write arbitrary physical memory, leading to code execution on the BMC operating system. The issue is rated CVSS 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and classified CWE-287; exploitation requires valid IPMI Administrator credentials and network access to the BMC management interface. No public exploit code has been identified at time of analysis, EPSS is 0.32% (24th percentile), and the vuln.today priority is this_week, so this is a moderate, authentication-gated risk rather than an emergency.
Unauthenticated remote attackers can establish an RMCP+ session on Supermicro MBD-X12SPI baseboard management controllers running BMC firmware 1.07.20 by sending a request immediately followed by a specially crafted RAKP message, abusing incorrect ordering in the RAKP+ authentication handshake; a session established this way could then be used to execute commands. The flaw is rated CVSS 7.4 (AV:N/AC:H/PR:N/UI:N, high confidentiality and integrity impact, no availability impact) and requires network reachability to the BMC's RMCP+/IPMI 2.0 interface, typically UDP 623. EPSS is 0.45% (39th percentile), the CVE is not listed in CISA KEV and no public exploit has been identified at time of analysis; this is a genuine but second-tier priority rather than a drop-everything emergency.
Command injection in Supermicro MBD-X12SPI BMC/IPMI firmware 01.07.20 allows a holder of IPMI administrator credentials to execute arbitrary commands as the operating system root user on the BMC. The flaw is reachable over the network without user interaction, but exploitation requires prior administrative access to the IPMI interface, making it a privilege-escalation path from BMC admin to OS root rather than an unauthenticated takeover. No public exploit code or active exploitation is confirmed at time of analysis, and EPSS is 0.54% (45th percentile), indicating low predicted exploitation activity.
Predictable session-token generation in the HTML5 KVM-over-IP console of the Supermicro MBD-X12SPI BMC/IPMI web interface (firmware 01.07.20) allows a remote attacker to guess a token issued by the web interface and hijack an active KVM session, gaining access to the console's display and input path. Per the assessed vector the flaw is network-reachable and unauthenticated (AV:N/PR:N), but exploitation is constrained by high attack complexity (the token must actually be guessed or predicted) and by the requirement that a legitimate KVM session already be in use (UI:R). It is not listed in CISA KEV, no public exploit code has been identified at time of analysis, and EPSS is 0.15% (4th percentile), consistent with a 'monitor' decision label and low real-world priority; the dominant limiting factor remains deployment, since BMC management interfaces are normally confined to an isolated management LAN.