CVE-2019-16650: supermicro a1sa2-2750f_firmware
Vulnerability summary
CVE-2019-16650 is a critical (CVSS 10.0) vulnerability in supermicro a1sa2-2750f_firmware. EPSS estimates a 2.16% chance of exploitation in the next 30 days, higher than 81.9% of scored vulnerabilities.
Timeline
- 21-09-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number. In opportunistic circumstances, an attacker can simply connect to the virtual media service, and then connect virtual USB devices to the server managed by the BMC.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
2.16%
Chance of exploitation in the next 30 days
Percentile
82%
Versus all other CVEs
30-day change
0.00 pp
From 2.16% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Supermicro200 products
- a1sa2-2750f_firmware3.83
- a1sai-2550f_firmware3.83
- a1sai-2750f_firmware3.83
- a1sam-2550f_firmware3.83
- a1sam-2750f_firmware3.83
1 vendor · 200 products · Showing 200 of 254. Use Open JSON for the complete list.
References
3 links- eclypsium.com/2019/09/03/usbanywhere-bmc-vulnerability-opens-servers-to-remote-attack/X Refsource MISCMitigationThird Party Advisory