SMCI vulnerabilities
We track 17 vulnerabilities in SMCI products across 11 products. 17 are rated high or critical, and none are known to be exploited. The most recent was published on October 27, 2026.
Latest SMCI vulnerabilities
- 7.2 High severity
MBD-X12SPI: Improper Authentication
This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby execute code on the BMC operating system.
- 8.8 High severity
MBD-X12SPI: Improper Privilege Management
A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges.
- 7.4 High severity
MBD-X12SPI: Incorrect Behavior Order
A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands.
- 9.8 Critical severity
X12SPI: Missing Authentication for Critical Functionality
The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.
- 7.5 High severity
X12SPI: Use of Hard-coded Credentials
The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.
- 7.2 High severity
MBD-X12STW-F: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists because of insufficient input filtering. An attacker can inject a command payload into a BMC function; the payload may execute when the related service is restarted.
- 8.8 High severity
X14DBG-DAP,X14DBI: Improper Neutralization of Special Elements used in an OS Command
Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI. An authorized attacker can exploit SMASH’s input capability to compromise data integrity or launch a Denial-of-Service (DoS) attack against the BMC.
- 7.2 High severity
AS-2115HS-TNR: Improper Neutralization of Special Elements used in an OS Command
There is a vulnerability in the Supermicro BMC SMTP service at Supermicro AS-2115HS-TNR. An attacker may obtain administrator privileges and inject specially crafted characters into the SMTP service configuration. This may cause the underlying system to execut
- 8.4 High severity
X13SEM-F: Improper Verification of Cryptographic Signature
There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X13SEM-F . An attacker can update the system firmware with a specially crafted image.
- 7.2 High severity
X12STW-F: Improper Verification of Cryptographic Signature
There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X12STW-F . An attacker can update the system firmware with a specially crafted image.
- 7.2 High severity
X13SEDW-F: Stack-based Buffer Overflow
There is a vulnerability in the Supermicro BMC web function at Supermicro MBD-X13SEDW-F. After logging into the BMC Web server, an attacker can use a specially crafted payload to trigger the Stack buffer overflow vulnerability.
- 7.2 High severity
MBD-X13SEDW-F: Stack-based Buffer Overflow
There is a vulnerability in the Supermicro BMC web function at Supermicro MBD-X13SEDW-F. After logging into the BMC Web server, an attacker can use a specially crafted payload to trigger the Stack buffer overflow vulnerability.
- 7.2 High severity
MBD-X12STW: Improper Verification of Cryptographic Signature
There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X12STW . An attacker can update the system firmware with a specially crafted image.
- 7.2 High severity
X13SEM-F: Improper Verification of Cryptographic Signature
There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X13SEM-F . An attacker can update the system firmware with a specially crafted image.
- 7.2 High severity
MBD-X12DPG-OA6: Stack-based Buffer Overflow
A security issue in the firmware image verification implementation at Supermicro MBD-X12DPG-OA6 . An attacker with administrator privileges can upload a specially crafted image, which can cause a stack overflow due to the unchecked fat->fsd.max_fld.
- 7.2 High severity
MBD-X12DPG-OA6: Stack-based Buffer Overflow
A security issue in the firmware image verification implementation at Supermicro MBD-X12DPG-OA6. An attacker can upload a specially crafted image that will cause a stack overflow is caused by not checking fld->used_bytes.
- 7.2 High severity
MBD-X12DPG-OA6: Insufficient Verification of Data Authenticity
There is a vulnerability in the BMC firmware image authentication design at Supermicro MBD-X12DPG-OA6 . An attacker can modify the firmware to bypass BMC inspection and bypass the signature verification process