CVE-2013-3619: citrix netscaler Use of Hard-coded Credentials
Vulnerability summary
CVE-2013-3619 is a high (CVSS 8.1) Use of Hard-coded Credentials vulnerability in citrix netscaler. EPSS estimates a 9.69% chance of exploitation in the next 30 days, higher than 95.4% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 02-01-2020PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before SMT_X9_317 and firmware for Supermicro X8 generation motherboards before SMT X8 312 contain harcoded private encryption keys for the (1) Lighttpd web server SSL interface and the (2) Dropbear SSH daemon.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
9.69%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
0.00 pp
From 9.69% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundSupermicro Onboard IPMI Static SSL Certificate Scanner
auxiliary/scanner/http/smt_ipmi_static_cert_scanner
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Citrix3 products
Supermicro3 products
- ipmi< SMT_X9_317 and before SMT X8 312
- smt_x8_firmware< 3.12
- smt_x9_firmware< 3.15
2 vendors · 6 products
References
5 links- community.rapid7.com/community/metasploit/blog/2013/11/05/supermicro-ipmi-firmware-vulnerabilitiesX Refsource MISCThird Party Advisory