Supermicro vulnerabilities
We track 8 vulnerabilities in Supermicro products across 60+ products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on July 15, 2024.
Latest Supermicro vulnerabilities
- 7.5 High severity
x11dpg-hgx2_firmware: Improper Write Handling in Limited-write Non-Volatile Memories
An arbitrary memory write vulnerability was discovered in Supermicro X11DPG-HGX2, X11PDG-QT, X11PDG-OT, and X11PDG-SN motherboards with BIOS firmware before 4.4.
- 9.8 Critical severity
x13swa-tf_firmware: Stack-based Buffer Overflow
An issue was discovered on Supermicro BMC firmware in select X11, X12, H12, B12, X13, H13, and B13 motherboards (and CMM6 modules). An unauthenticated user can post crafted data to the interface that triggers a stack buffer overflow, and may lead to arbitrary
- 8.3 High severity
x11ssm-f_firmware: Improper Neutralization of Input During Web Page Generation
An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue that affects Internet Explorer 11 on Windows.
- 7.2 High severity
x11ssm-f: Improper Privilege Management
A command injection issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker can exploit this to elevate privileges from a user with BMC administrative privileges.
- 8.8 High severity
M11sdv-4c-ln4f Firmware: Use of Hard-coded Credentials
The configuration functionality in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions through 3.17.02, allows remote authenticated users to e
- 7.5 High severity
M11sdv-4c-ln4f Firmware: Improper Limitation of a Pathname to a Restricted Directory
A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions up to 3.17.02, allows remote unauthenticated users to perform directory tr
- 7.8 High severity
x12dpg-qr: Out-of-bounds Write
Buffer Overflow vulnerability in Supermicro motherboard X12DPG-QR 1.4b allows local attackers to hijack control flow via manipulation of SmcSecurityEraseSetupVar variable.
- 9.8 Critical severity
h12dst-b: Improper Neutralization of Special Elements used in an OS Command
A shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before 03.10.35) allows remote attackers to inject execute arbitrary commands as root on the BMC.