CVE-2023-35861

CVE-2023-35861 affects Supermicro BMC firmware on H12DST-B (and related X12/X13/H12/H13 models) where a shell-injection in SMTP/email notifications allows remote command execution as root on the BMC. Root cause: shell-injection in the notification path; impact is arbitrary commands with root priv...

CVE-2023-34853

CVE-2023-34853 affects Supermicro motherboard X12DPG-QR version 1.4b. The vulnerability is a buffer overflow in SmcSecurityEraseSetupVar that enables a local attacker to hijack control flow. Affected component/file: SmcSecurityEraseSetupVar within the firmware/BIOS context of the X12DPG-QR family...

CVE-2023-33411

CVE-2023-33411 impacts Supermicro X11 and M11 devices with firmware up to 3.17.02, where a web server in the IPMI BMC implementation allows remote unauthenticated users to perform directory traversal, potentially disclosing sensitive information. Several connected sources corroborate the affected...

CVE-2023-33413

The PT-Security entry for CVE-2023-33413 details a flaw in Supermicro IPMI BMC on X11/M11 devices up to firmware 3.17.02. The root cause is hardcoded configuration file encryption keys used by the IPMI BMC config function, enabling remote authenticated users to craft/upload a malicious configurat...

CVE-2023-33412

The CVE-2023-33412 issue affects Supermicro X11 and M11-based devices with IPMI BMC. Firmware versions before 3.17.02 expose a vulnerability where remote authenticated users can execute arbitrary commands by sending crafted requests to vulnerable CGI endpoints. Impact is described as high for con...