Supermicro
Monthly
Privilege escalation in the Supermicro BMC IPMI implementation allows an attacker who already holds a low-privilege BMC account to send crafted RAKP+ authentication messages and gain administrator-level access on affected MBD-X12SPI systems running firmware 01.07.20. The issue is rated CVSS 8.8 because exploitation is network-reachable, requires low privileges, and yields high confidentiality, integrity, and availability impact, although EPSS is low at 0.26% (17th percentile). No public exploit identified at time of analysis; reachability is limited to BMC management interfaces, typically IPMI/RMCP+ on UDP 623.
Unauthenticated remote attackers who can reach the Supermicro X12SPI BMC's IPMI interface may be able to bypass integrity and encryption enforcement and execute arbitrary commands against an active IPMI session. The flaw is rated CVSS 9.8 (CWE-306), but exposure is limited by the need for network reachability to the BMC management interface and an existing active session. The vuln.today decision label is act_now, while EPSS is 0.40% (34th percentile) and no CISA KEV entry or public exploit was identified in the provided data.
Supermicro's X12SPI BMC firmware (01.07.20) does not enforce the integrity and encryption requirements it is supposed to apply to IPMI commands, so an attacker who can reach the management interface can craft packets that execute arbitrary commands inside an already-active IPMI session. The CVSS vector is unauthenticated (PR:N), but exploitation is conditional: the BMC must be network-reachable and a live session must already exist for the attacker to act against, which is why the assessed severity combines high confidentiality, integrity and availability impact with high attack complexity. There is no KEV listing, EPSS is 0.34% (27th percentile) and no public exploit code was identified at time of analysis; the vuln.today decision label is this_week, a genuine but non-emergency priority.
Multiple stack-based buffer overflows in cgi/close_window.cgi in the web interface in the Intelligent Platform Management Interface (IPMI) with firmware before 3.15 (SMT_X9_315) on Supermicro X9. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.4%.
Arbitrary file read in Supermicro BMC/IPMI firmware 01.07.20 allows an authenticated IPMI Administrator to retrieve files from the BMC filesystem, disclosing information beyond the intended IPMI management role. The CVSS 3.1 score is 4.9 with a vector of AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, so exploitation requires high-privilege IPMI credentials and affects confidentiality only. EPSS is low at 0.23% (14th percentile), there is no CISA KEV confirmation, and no public exploit was identified at time of analysis; real-world exposure is further limited where BMC/IPMI interfaces are isolated on management networks.
Command injection in Supermicro MBD-X12SPI BMC/IPMI firmware 01.07.20 allows a holder of IPMI administrator credentials to execute arbitrary commands as the operating system root user on the BMC. The flaw is reachable over the network without user interaction, but exploitation requires prior administrative access to the IPMI interface, making it a privilege-escalation path from BMC admin to OS root rather than an unauthenticated takeover. No public exploit code or active exploitation is confirmed at time of analysis, and EPSS is 0.54% (45th percentile), indicating low predicted exploitation activity.
Predictable session-token generation in the HTML5 KVM-over-IP console of the Supermicro MBD-X12SPI BMC/IPMI web interface (firmware 01.07.20) allows a remote attacker to guess a token issued by the web interface and hijack an active KVM session, gaining access to the console's display and input path. Per the assessed vector the flaw is network-reachable and unauthenticated (AV:N/PR:N), but exploitation is constrained by high attack complexity (the token must actually be guessed or predicted) and by the requirement that a legitimate KVM session already be in use (UI:R). It is not listed in CISA KEV, no public exploit code has been identified at time of analysis, and EPSS is 0.15% (4th percentile), consistent with a 'monitor' decision label and low real-world priority; the dominant limiting factor remains deployment, since BMC management interfaces are normally confined to an isolated management LAN.
The configuration functionality in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The web interface in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions before. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions up to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Buffer Overflow vulnerability in Supermicro motherboard X12DPG-QR 1.4b allows local attackers to hijack control flow via manipulation of SmcSecurityEraseSetupVar variable. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before 03.10.35) allows remote attackers to inject execute arbitrary commands as root on the BMC. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Supermicro X11SSL-CF HW Rev 1.01, BMC firmware v1.63 was discovered to contain insecure permissions. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to compromise BIOS firmware. Rated low severity (CVSS 2.3), this vulnerability is low attack complexity.
The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 allows remote attackers to exploit a cgi/config_user.cgi CSRF issue to add new admin users. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who can send HTTP requests to the IPMI IP. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of BMC credentials and data transferred. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Super Micro SuperDoctor 5, when restrictions are not implemented in agent.cfg, allows remote attackers to execute arbitrary commands via NRPE. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Certain Supermicro X11S, X10, X9, X8SI, K1SP, C9X299, C7, B1, A2, and A1 products have a misconfigured Descriptor Region, allowing OS programs to modify firmware. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Buffer overflow in logout.cgi in the Intelligent Platform Management Interface (IPMI) with firmware before 3.15 (SMT_X9_315) on Supermicro X9 generation motherboards allows remote authenticated users. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-*, X9DB*, X9DR*, X9QR*,. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-*, X9DB*, X9DR*, X9QR*,. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple stack-based buffer overflows in the web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*,. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 14.6%.
The Supermicro BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 64.1%.
Privilege escalation in the Supermicro BMC IPMI implementation allows an attacker who already holds a low-privilege BMC account to send crafted RAKP+ authentication messages and gain administrator-level access on affected MBD-X12SPI systems running firmware 01.07.20. The issue is rated CVSS 8.8 because exploitation is network-reachable, requires low privileges, and yields high confidentiality, integrity, and availability impact, although EPSS is low at 0.26% (17th percentile). No public exploit identified at time of analysis; reachability is limited to BMC management interfaces, typically IPMI/RMCP+ on UDP 623.
Unauthenticated remote attackers who can reach the Supermicro X12SPI BMC's IPMI interface may be able to bypass integrity and encryption enforcement and execute arbitrary commands against an active IPMI session. The flaw is rated CVSS 9.8 (CWE-306), but exposure is limited by the need for network reachability to the BMC management interface and an existing active session. The vuln.today decision label is act_now, while EPSS is 0.40% (34th percentile) and no CISA KEV entry or public exploit was identified in the provided data.
Supermicro's X12SPI BMC firmware (01.07.20) does not enforce the integrity and encryption requirements it is supposed to apply to IPMI commands, so an attacker who can reach the management interface can craft packets that execute arbitrary commands inside an already-active IPMI session. The CVSS vector is unauthenticated (PR:N), but exploitation is conditional: the BMC must be network-reachable and a live session must already exist for the attacker to act against, which is why the assessed severity combines high confidentiality, integrity and availability impact with high attack complexity. There is no KEV listing, EPSS is 0.34% (27th percentile) and no public exploit code was identified at time of analysis; the vuln.today decision label is this_week, a genuine but non-emergency priority.
Multiple stack-based buffer overflows in cgi/close_window.cgi in the web interface in the Intelligent Platform Management Interface (IPMI) with firmware before 3.15 (SMT_X9_315) on Supermicro X9. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 86.4%.
Arbitrary file read in Supermicro BMC/IPMI firmware 01.07.20 allows an authenticated IPMI Administrator to retrieve files from the BMC filesystem, disclosing information beyond the intended IPMI management role. The CVSS 3.1 score is 4.9 with a vector of AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, so exploitation requires high-privilege IPMI credentials and affects confidentiality only. EPSS is low at 0.23% (14th percentile), there is no CISA KEV confirmation, and no public exploit was identified at time of analysis; real-world exposure is further limited where BMC/IPMI interfaces are isolated on management networks.
Command injection in Supermicro MBD-X12SPI BMC/IPMI firmware 01.07.20 allows a holder of IPMI administrator credentials to execute arbitrary commands as the operating system root user on the BMC. The flaw is reachable over the network without user interaction, but exploitation requires prior administrative access to the IPMI interface, making it a privilege-escalation path from BMC admin to OS root rather than an unauthenticated takeover. No public exploit code or active exploitation is confirmed at time of analysis, and EPSS is 0.54% (45th percentile), indicating low predicted exploitation activity.
Predictable session-token generation in the HTML5 KVM-over-IP console of the Supermicro MBD-X12SPI BMC/IPMI web interface (firmware 01.07.20) allows a remote attacker to guess a token issued by the web interface and hijack an active KVM session, gaining access to the console's display and input path. Per the assessed vector the flaw is network-reachable and unauthenticated (AV:N/PR:N), but exploitation is constrained by high attack complexity (the token must actually be guessed or predicted) and by the requirement that a legitimate KVM session already be in use (UI:R). It is not listed in CISA KEV, no public exploit code has been identified at time of analysis, and EPSS is 0.15% (4th percentile), consistent with a 'monitor' decision label and low real-world priority; the dominant limiting factor remains deployment, since BMC management interfaces are normally confined to an isolated management LAN.
The configuration functionality in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The web interface in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions before. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions up to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Buffer Overflow vulnerability in Supermicro motherboard X12DPG-QR 1.4b allows local attackers to hijack control flow via manipulation of SmcSecurityEraseSetupVar variable. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before 03.10.35) allows remote attackers to inject execute arbitrary commands as root on the BMC. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Supermicro X11SSL-CF HW Rev 1.01, BMC firmware v1.63 was discovered to contain insecure permissions. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to compromise BIOS firmware. Rated low severity (CVSS 2.3), this vulnerability is low attack complexity.
The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 allows remote attackers to exploit a cgi/config_user.cgi CSRF issue to add new admin users. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who can send HTTP requests to the IPMI IP. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of BMC credentials and data transferred. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Super Micro SuperDoctor 5, when restrictions are not implemented in agent.cfg, allows remote attackers to execute arbitrary commands via NRPE. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Certain Supermicro X11S, X10, X9, X8SI, K1SP, C9X299, C7, B1, A2, and A1 products have a misconfigured Descriptor Region, allowing OS programs to modify firmware. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
Buffer overflow in logout.cgi in the Intelligent Platform Management Interface (IPMI) with firmware before 3.15 (SMT_X9_315) on Supermicro X9 generation motherboards allows remote authenticated users. Rated critical severity (CVSS 9.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-*, X9DB*, X9DR*, X9QR*,. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-*, X9DB*, X9DR*, X9QR*,. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Multiple stack-based buffer overflows in the web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*,. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 14.6%.
The Supermicro BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 64.1%.