Supermicro vulnerabilities
29 vulnerabilities
Known vulnerabilities in Supermicro products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 807 products.
Products
50 of 807- X11Sse F14 vulnerabilities
- X11Ssm F14 vulnerabilities
- X11Sae F10 vulnerabilities
- X11Dac7 vulnerabilities
- X11Dai N7 vulnerabilities
- X11Ddw L7 vulnerabilities
- X11Ddw Nt7 vulnerabilities
- X11Dgo T7 vulnerabilities
- X11Dgq7 vulnerabilities
- X11Dpff Sn7 vulnerabilities
- X11Dpfr S7 vulnerabilities
- X11Dpfr Sn7 vulnerabilities
- X11Dpg Ot Cpu7 vulnerabilities
- X11Dpg Qt7 vulnerabilities
- X11Dpg Sn7 vulnerabilities
- X11Dph I7 vulnerabilities
- X11Dph T7 vulnerabilities
- X11Dph Tq7 vulnerabilities
- X11Dpi N7 vulnerabilities
- X11Dpi Nt7 vulnerabilities
- X11Dpl I7 vulnerabilities
- X11Dps Re7 vulnerabilities
- X11Dpt B7 vulnerabilities
- X11Dpt Bh7 vulnerabilities
- X11Dpt L7 vulnerabilities
- X11Dpt Ps7 vulnerabilities
- X11Dpu7 vulnerabilities
- X11Dpu V7 vulnerabilities
- X11Dpu Xll7 vulnerabilities
- X11Dpu Z\+7 vulnerabilities
- X11Dpu Ze\+7 vulnerabilities
- X11Dpx T7 vulnerabilities
- X11Dsc\+7 vulnerabilities
- X11Dsf E7 vulnerabilities
- X11Dsn Ts7 vulnerabilities
- X11Dsn Tsq7 vulnerabilities
- X11Opi Cpu7 vulnerabilities
- X11Qph\+7 vulnerabilities
- X11Sca7 vulnerabilities
- X11Sca F7 vulnerabilities
- X11Sca W7 vulnerabilities
- X11Scd F7 vulnerabilities
- X11Sch F7 vulnerabilities
- X11Sch Ln4F7 vulnerabilities
- X11Scl F7 vulnerabilities
- X11Scl If7 vulnerabilities
- X11Scl Ln4F7 vulnerabilities
- X11Scm F7 vulnerabilities
- X11Scm Ln8F7 vulnerabilities
- X11Scw F7 vulnerabilities
CVE-2018-13787supermicroa1sa_firmware+109
EPSS score0.42%
Certain Supermicro X11S, X10, X9, X8SI, K1SP, C9X299, C7, B1, A2, and A1 products have a misconfigured Descriptor Region, allowing OS programs to modify firmware.CVE-2013-6785supermicrointelligent_platform_management_interfaceEPSS score4.36%
Directory traversal vulnerability in url_redirect.cgi in Supermicro IPMI before SMT_X9_315 allows authenticated attackers to read arbitrary files via the url_name parameter.CVE-2013-3622supermicrointelligent_platform_management_firmwareEPSS score5.41%
Buffer overflow in logout.cgi in the Intelligent Platform Management Interface (IPMI) with firmware before 3.15 (SMT_X9_315) on Supermicro X9 generation motherboards allows remote authenticated users to execute arbitrary code via the SID parameter.CVE-2013-3607supermicroh8dcl-6f+125EPSS score9.73%
Multiple stack-based buffer overflows in the web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-*, X9DB*, X9DR*, X9QR*, X9SBAA-F, X9SC*, X9SPU-F, and X9SR* devices allow remote attackers to execute arbitrary code on the Baseboard Management Controller (BMC), as demonstrated by the (1) username or (2) password field in login.cgi.CVE-2013-3608supermicroh8dcl-6f+125EPSS score6.41%
The web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-*, X9DB*, X9DR*, X9QR*, X9SBAA-F, X9SC*, X9SPU-F, and X9SR* devices allows remote authenticated users to execute arbitrary commands via shell metacharacters, as demonstrated by the IP address field in config_date_time.cgi.CVE-2013-3623supermicrointelligent_platform_management_firmwareEPSS score72.38%
Multiple stack-based buffer overflows in cgi/close_window.cgi in the web interface in the Intelligent Platform Management Interface (IPMI) with firmware before 3.15 (SMT_X9_315) on Supermicro X9 generation motherboards allow remote attackers to execute arbitrary code via the (1) sess_sid or (2) ACT parameter.CVE-2013-3609supermicroh8dcl-6f+125EPSS score5.31%
The web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-*, X9DB*, X9DR*, X9QR*, X9SBAA-F, X9SC*, X9SPU-F, and X9SR* devices relies on JavaScript code on the client for authorization checks, which allows remote authenticated users to bypass intended access restrictions via a crafted request, related to the PrivilegeCallBack function.CVE-2013-3620citrixnetscaler+5EPSS score3.63%
Hardcoded WSMan credentials in Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before 3.15 (SMT_X9_315) and firmware for Supermicro X8 generation motherboards before SMT X8 312.CVE-2013-3619citrixnetscaler+5EPSS score9.69%
Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before SMT_X9_317 and firmware for Supermicro X8 generation motherboards before SMT X8 312 contain harcoded private encryption keys for the (1) Lighttpd web server SSL interface and the (2) Dropbear SSH daemon.CVE-2021-22887pulsesecurepsa-5000_firmware+10EPSS score0.28%
A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to compromise BIOS firmware. This vulnerability can be exploited only as part of an attack chain. Before an attacker can compromise the BIOS, they must exploit the device.CVE-2020-15046supermicrox10drh-it_firmwareEPSS score2.30%
The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 allows remote attackers to exploit a cgi/config_user.cgi CSRF issue to add new admin users. The fixed versions are BIOS 3.2 and firmware 03.88.CVE-2022-43309supermicroh11dsi_firmware+145EPSS score0.15%
Supermicro X11SSL-CF HW Rev 1.01, BMC firmware v1.63 was discovered to contain insecure permissions.CVE-2024-8105aceraltos r680 f4+742EPSS score0.27%
A vulnerability exists in UEFI implementations that use a hard-coded software-based Platform Key (PK). An attacker in possession of the corresponding PK private key can sign arbitrary UEFI executables or firmware components, causing them to be trusted by affected systems and potentially bypassing UEFI Secure Boot trust validation.CVE-2019-16650supermicroa1sa2-2750f_firmware+253EPSS score2.16%
On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number. In opportunistic circumstances, an attacker can simply connect to the virtual media service, and then connect virtual USB devices to the server managed by the BMC.CVE-2019-16649supermicroa1sa2-2750f_firmware+320EPSS score0.93%
On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of BMC credentials and data transferred over virtual media devices. Attackers can use captured credentials to connect virtual USB devices to the server managed by the BMC.CVE-2019-13131supermicrosuperdoctor_5EPSS score3.58%
Super Micro SuperDoctor 5, when restrictions are not implemented in agent.cfg, allows remote attackers to execute arbitrary commands via NRPE.CVE-2019-19642supermicrox8sti-f_biosEPSS score19.04%
On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who can send HTTP requests to the IPMI IP address. This requires a POST to /rpc/setvmdrive.asp with shell metacharacters in ShareHost or ShareName. The attacker can achieve a persistent backdoor.CVE-2023-40290supermicrox11sae-f_firmware+2EPSS score0.70%
An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue that affects Internet Explorer 11 on Windows.CVE-2023-40288supermicrox11sae-f_firmware+2EPSS score0.60%
An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue.CVE-2023-40289supermicrox11sae-f_firmware+2EPSS score18.27%
A command injection issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker can exploit this to elevate privileges from a user with BMC administrative privileges.