Security Bulletin: This Power System update is being released to address CVE-2018-13787

Summary POWER8/POWER9: In response to a potential issue with validation checking of IBM firmware, a new firmware update is being released to address Common Vulnerabilities and Exposures issue number CVE-2018-13787. Vulnerability Details CVEID: CVE-2018-13787 DESCRIPTION: Certain Supermicro X11S,...

Weak Password Vulnerability in SuperMicro IPMI/iKVM

Supermicro IPMI/iKVM is a management tool developed by Supermicro Computer Corporation for its on-board IPMI card, which can be used to boot up the system remotely, enter the BIOS, etc. for system control. Supermicro IPMI/iKVM suffers from a weak password vulnerability that can be exploited by an...

Weak Password Vulnerability in SuperMicro SuperDoctor5

SuperMicro SuperDoctor5 is a server management monitoring platform. The platform is mainly used for real-time monitoring the system operation status or availability of target node hardware in the data center. SuperMicro SuperDoctor5 has a weak password vulnerability that can be exploited by an...

Chinese Supply-Chain Attack on Computer Systems

Bloomberg News has a major story about the Chinese hacking computer motherboards made by Supermicro, Levono, and others. Its been going on since at least 2008. The US government has known about it for almost as long, and has tried to keep the attack secret: Chinas exploitation of products made by...

SuperMicro IPMI WebInterface 03.40 - Cross-Site Request Forgery (Add Admin) Vulnerability

Exploit for hardware platform in category web applications Exploit Title: SuperMicro IPMI WebInterface 03.40 - Cross-Site Request Forgery Add Admin Exploit Author: Metin Yunus Kandemir Vendor Homepage: https://www.supermicro.com/ Version: X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware...

SuperMicro IPMI WebInterface 03.40 - Cross-Site Request Forgery (Add Admin)

Exploit Title: SuperMicro IPMI WebInterface 03.40 - Cross-Site Request Forgery Add Admin Exploit Author: Metin Yunus Kandemir Date: 2020-07-15 Vendor Homepage: https://www.supermicro.com/ Version: X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 CVE: CVE-2020-15046 Source:...

SuperMicro IPMI 03.40 Cross Site Request Forgery

Exploit Title: SuperMicro IPMI 03.40 - Cross-Site Request Forgery Add Admin Exploit Author: Metin Yunus Kandemir Vendor Homepage: https://www.supermicro.com/ Software Link: https://www.supermicro.com/en/solutions/management-software/bmc-resources Version: X10DRH-iT motherboards with BIOS 2.0a and...

SuperMicro IPMI 03.40 - Cross-Site Request Forgery (Add Admin)

Exploit Title: SuperMicro IPMI 03.40 - Cross-Site Request Forgery Add Admin Exploit Author: Metin Yunus Kandemir Vendor Homepage: https://www.supermicro.com/ Software Link: https://www.supermicro.com/en/solutions/management-software/bmc-resources Version: X10DRH-iT motherboards with BIOS 2.0a and...

SuperMicro IPMI 03.40 - Cross-Site Request Forgery (Add Admin) Vulnerability

Exploit for hardware platform in category web applications Exploit Title: SuperMicro IPMI 03.40 - Cross-Site Request Forgery Add Admin Exploit Author: Metin Yunus Kandemir Vendor Homepage: https://www.supermicro.com/ Software Link:...

SuperMicro Supermicro X10DRH-iT Cross-Site Request Forgery Vulnerability

The SuperMicro Supermicro X10DRH-iT is a server motherboard from SuperMicro USA. A security vulnerability exists in the web interface of the Supermicro X10DRH-iT motherboard BIOS version 2.0a and IPMI firmware version 03.40. The vulnerability can be exploited by a remote attacker to add a new...

CVE-2020-15046

The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 allows remote attackers to exploit a cgi/configuser.cgi CSRF issue to add new admin users. The fixed versions are BIOS 3.2 and firmware 03.88...

CVE-2020-15046

The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 allows remote attackers to exploit a cgi/configuser.cgi CSRF issue to add new admin users. The fixed versions are BIOS 3.2 and firmware 03.88...

CVE-2020-15046

The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 allows remote attackers to exploit a cgi/configuser.cgi CSRF issue to add new admin users. The fixed versions are BIOS 3.2 and firmware 03.88...

Cross site request forgery (csrf)

The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 allows remote attackers to exploit a cgi/configuser.cgi CSRF issue to add new admin users. The fixed versions are BIOS 3.2 and firmware 03.88...

CVE-2020-15046

This CVE (CVE-2020-15046) affects Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40. The web interface exposes a CSRF vulnerability in cgi/config_user.cgi that allows remote attacker to add a new admin user, with fixed versions BIOS 3.2 and IPMI firmware 03.88. Evidenced de...

CVE-2020-15046

The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 allows remote attackers to exploit a cgi/configuser.cgi CSRF issue to add new admin users. The fixed versions are BIOS 3.2 and firmware 03.88...

PT-2020-14142 · Supermicro · Supermicro X10Drh-It

Name of the Vulnerable Software and Affected Versions: Supermicro X10DRH-iT motherboards with BIOS version 2.0a and IPMI firmware version 03.40 Description: The issue allows remote attackers to exploit a CSRF problem in the cgi/config user.cgi file through the web interface, enabling them to add...

CVE-2013-6785

Directory traversal vulnerability in urlredirect.cgi in Supermicro IPMI before SMTX9315 allows authenticated attackers to read arbitrary files via the urlname parameter...

Directory traversal

Directory traversal vulnerability in urlredirect.cgi in Supermicro IPMI before SMTX9315 allows authenticated attackers to read arbitrary files via the urlname parameter...

CVE-2013-6785

CVE-2013-6785 describes a directory traversal vulnerability in the url_redirect.cgi component of Supermicro IPMI before SMT_X9_315. The flaw allows authenticated attackers to read arbitrary files by supplying a crafted value in the url_name parameter. The affected product is Supermicro IPMI (firm...