Search
Find a vulnerability
Search criteria
12 vulnerabilities found for MBD-X12SPI by SMCI
CVE-2026-65213 (GCVE-0-2026-65213)
Vulnerability from nvd – Published: 2026-10-27 08:15 – Updated: 2026-10-27 08:15
VLAI
EPSS
VEX
Title
Supermicro BMC IPMI feature contains a Arbitrary Command Execution with Superuser Privileges vulnerability
Summary
This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the BMC
Severity
6.6 (Medium)
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SMCI | MBD-X12SPI |
Affected:
01.07.20
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"BMC"
],
"product": "MBD-X12SPI",
"vendor": "SMCI",
"versions": [
{
"status": "affected",
"version": "01.07.20",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "runZero"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the BMC"
}
],
"value": "This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the BMC"
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88: OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T08:15:32.294Z",
"orgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"shortName": "Supermicro"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Supermicro BMC IPMI feature contains a Arbitrary Command Execution with Superuser Privileges vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"assignerShortName": "Supermicro",
"cveId": "CVE-2026-65213",
"datePublished": "2026-10-27T08:15:32.294Z",
"dateReserved": "2026-07-21T20:14:39.682Z",
"dateUpdated": "2026-10-27T08:15:32.294Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65211 (GCVE-0-2026-65211)
Vulnerability from nvd – Published: 2026-10-27 08:12 – Updated: 2026-10-27 08:12
VLAI
EPSS
VEX
Title
Supermicro BMC IPMI feature contains Critical Privilege Escalation and Arbitrary Access vulnerability
Summary
This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby execute code on the BMC operating system.
Severity
7.2 (High)
CWE
- CWE-287 - Improper Authentication
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SMCI | MBD-X12SPI |
Affected:
01.07.20
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"BMC"
],
"product": "MBD-X12SPI",
"vendor": "SMCI",
"versions": [
{
"status": "affected",
"version": "01.07.20",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "runZero"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby execute code on the BMC operating system."
}
],
"value": "This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby execute code on the BMC operating system."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233: Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T08:12:15.451Z",
"orgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"shortName": "Supermicro"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Supermicro BMC IPMI feature contains Critical Privilege Escalation and Arbitrary Access vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"assignerShortName": "Supermicro",
"cveId": "CVE-2026-65211",
"datePublished": "2026-10-27T08:12:15.451Z",
"dateReserved": "2026-07-21T20:14:39.682Z",
"dateUpdated": "2026-10-27T08:12:15.451Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65220 (GCVE-0-2026-65220)
Vulnerability from nvd – Published: 2026-10-27 08:02 – Updated: 2026-10-27 08:02
VLAI
EPSS
VEX
Title
Supermicro BMC IPMI feature contains a Privilege escalation vulnerability
Summary
A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges.
Severity
8.8 (High)
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SMCI | MBD-X12SPI |
Affected:
01.07.20
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"BMC"
],
"product": "MBD-X12SPI",
"vendor": "SMCI",
"versions": [
{
"status": "affected",
"version": "01.07.20",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "runZero"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges."
}
],
"value": "A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233: Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T08:02:49.783Z",
"orgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"shortName": "Supermicro"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Supermicro BMC IPMI feature contains a Privilege escalation vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"assignerShortName": "Supermicro",
"cveId": "CVE-2026-65220",
"datePublished": "2026-10-27T08:02:49.783Z",
"dateReserved": "2026-07-21T20:14:40.864Z",
"dateUpdated": "2026-10-27T08:02:49.783Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65219 (GCVE-0-2026-65219)
Vulnerability from nvd – Published: 2026-10-27 07:57 – Updated: 2026-10-27 07:57
VLAI
EPSS
VEX
Title
Supermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerability
Summary
A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands.
Severity
7.4 (High)
CWE
- CWE-696 - Incorrect Behavior Order
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SMCI | MBD-X12SPI |
Affected:
1.07.20
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"BMC"
],
"product": "MBD-X12SPI",
"vendor": "SMCI",
"versions": [
{
"status": "affected",
"version": "1.07.20",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "runZero"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands."
}
],
"value": "A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115: Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-696",
"description": "CWE-696: Incorrect Behavior Order",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T07:57:12.003Z",
"orgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"shortName": "Supermicro"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Supermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"assignerShortName": "Supermicro",
"cveId": "CVE-2026-65219",
"datePublished": "2026-10-27T07:57:12.003Z",
"dateReserved": "2026-07-21T20:14:40.863Z",
"dateUpdated": "2026-10-27T07:57:12.003Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65210 (GCVE-0-2026-65210)
Vulnerability from nvd – Published: 2026-10-27 08:07 – Updated: 2026-10-27 08:07
VLAI
EPSS
VEX
Title
Supermicro BMC IPMI feature contains Arbitrary File Access vulnerability
Summary
This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing material well beyond the intended IPMI management role.
Severity
4.9 (Medium)
CWE
- CWE-552 - Files or Directories Accessible to External Parties
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SMCI | MBD-X12SPI |
Affected:
01.07.20
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"BMC"
],
"product": "MBD-X12SPI",
"vendor": "SMCI",
"versions": [
{
"status": "affected",
"version": "01.07.20",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "runZero"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing material well beyond the intended IPMI management role."
}
],
"value": "This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing material well beyond the intended IPMI management role."
}
],
"impacts": [
{
"capecId": "CAPEC-251",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-251: Local File Inclusion"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-552",
"description": "CWE-552: Files or Directories Accessible to External Parties",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T08:07:16.704Z",
"orgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"shortName": "Supermicro"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Supermicro BMC IPMI feature contains Arbitrary File Access vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"assignerShortName": "Supermicro",
"cveId": "CVE-2026-65210",
"datePublished": "2026-10-27T08:07:16.704Z",
"dateReserved": "2026-07-21T20:14:39.682Z",
"dateUpdated": "2026-10-27T08:07:16.704Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18451 (GCVE-0-2026-18451)
Vulnerability from nvd – Published: 2026-10-27 07:51 – Updated: 2026-10-27 07:51
VLAI
EPSS
VEX
Title
Supermicro BMC's iKVM feature is vulnerable to KVM session hijacking due to a predictable time-seeded launch token
Summary
The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session.
Severity
CWE
- CWE-337 - Predictable Seed in a Pseudo-Random Number Generator (PRNG)
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SMCI | MBD-X12SPI |
Affected:
01.07.20
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"BMC"
],
"product": "MBD-X12SPI",
"vendor": "SMCI",
"versions": [
{
"status": "affected",
"version": "01.07.20",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "runZero"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session."
}
],
"value": "The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session."
}
],
"impacts": [
{
"capecId": "CAPEC-59",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-59: Session Hijacking"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-337",
"description": "CWE-337: Predictable Seed in a Pseudo-Random Number Generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T07:51:10.336Z",
"orgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"shortName": "Supermicro"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Supermicro BMC\u0027s iKVM feature is vulnerable to KVM session hijacking due to a predictable time-seeded launch token",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"assignerShortName": "Supermicro",
"cveId": "CVE-2026-18451",
"datePublished": "2026-10-27T07:51:10.336Z",
"dateReserved": "2026-07-31T05:37:17.153Z",
"dateUpdated": "2026-10-27T07:51:10.336Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65213 (GCVE-0-2026-65213)
Vulnerability from cvelistv5 – Published: 2026-10-27 08:15 – Updated: 2026-10-27 08:15
VLAI
EPSS
VEX
Title
Supermicro BMC IPMI feature contains a Arbitrary Command Execution with Superuser Privileges vulnerability
Summary
This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the BMC
Severity
6.6 (Medium)
CWE
- CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SMCI | MBD-X12SPI |
Affected:
01.07.20
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"BMC"
],
"product": "MBD-X12SPI",
"vendor": "SMCI",
"versions": [
{
"status": "affected",
"version": "01.07.20",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "runZero"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the BMC"
}
],
"value": "This issue may allow an IPMI authenticated administrator to execute commands as the operating system root user on the BMC"
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88: OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T08:15:32.294Z",
"orgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"shortName": "Supermicro"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Supermicro BMC IPMI feature contains a Arbitrary Command Execution with Superuser Privileges vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"assignerShortName": "Supermicro",
"cveId": "CVE-2026-65213",
"datePublished": "2026-10-27T08:15:32.294Z",
"dateReserved": "2026-07-21T20:14:39.682Z",
"dateUpdated": "2026-10-27T08:15:32.294Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65211 (GCVE-0-2026-65211)
Vulnerability from cvelistv5 – Published: 2026-10-27 08:12 – Updated: 2026-10-27 08:12
VLAI
EPSS
VEX
Title
Supermicro BMC IPMI feature contains Critical Privilege Escalation and Arbitrary Access vulnerability
Summary
This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby execute code on the BMC operating system.
Severity
7.2 (High)
CWE
- CWE-287 - Improper Authentication
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SMCI | MBD-X12SPI |
Affected:
01.07.20
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"BMC"
],
"product": "MBD-X12SPI",
"vendor": "SMCI",
"versions": [
{
"status": "affected",
"version": "01.07.20",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "runZero"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby execute code on the BMC operating system."
}
],
"value": "This issue may allow an authenticated IPMI Administrator to read and write arbitrary BMC physical memory and thereby execute code on the BMC operating system."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233: Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287: Improper Authentication",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T08:12:15.451Z",
"orgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"shortName": "Supermicro"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Supermicro BMC IPMI feature contains Critical Privilege Escalation and Arbitrary Access vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"assignerShortName": "Supermicro",
"cveId": "CVE-2026-65211",
"datePublished": "2026-10-27T08:12:15.451Z",
"dateReserved": "2026-07-21T20:14:39.682Z",
"dateUpdated": "2026-10-27T08:12:15.451Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65210 (GCVE-0-2026-65210)
Vulnerability from cvelistv5 – Published: 2026-10-27 08:07 – Updated: 2026-10-27 08:07
VLAI
EPSS
VEX
Title
Supermicro BMC IPMI feature contains Arbitrary File Access vulnerability
Summary
This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing material well beyond the intended IPMI management role.
Severity
4.9 (Medium)
CWE
- CWE-552 - Files or Directories Accessible to External Parties
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SMCI | MBD-X12SPI |
Affected:
01.07.20
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"BMC"
],
"product": "MBD-X12SPI",
"vendor": "SMCI",
"versions": [
{
"status": "affected",
"version": "01.07.20",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "runZero"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing material well beyond the intended IPMI management role."
}
],
"value": "This issue may allow an authenticated IPMI Administrator to read arbitrary files from the BMC filesystem, disclosing material well beyond the intended IPMI management role."
}
],
"impacts": [
{
"capecId": "CAPEC-251",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-251: Local File Inclusion"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-552",
"description": "CWE-552: Files or Directories Accessible to External Parties",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T08:07:16.704Z",
"orgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"shortName": "Supermicro"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Supermicro BMC IPMI feature contains Arbitrary File Access vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"assignerShortName": "Supermicro",
"cveId": "CVE-2026-65210",
"datePublished": "2026-10-27T08:07:16.704Z",
"dateReserved": "2026-07-21T20:14:39.682Z",
"dateUpdated": "2026-10-27T08:07:16.704Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65220 (GCVE-0-2026-65220)
Vulnerability from cvelistv5 – Published: 2026-10-27 08:02 – Updated: 2026-10-27 08:02
VLAI
EPSS
VEX
Title
Supermicro BMC IPMI feature contains a Privilege escalation vulnerability
Summary
A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges.
Severity
8.8 (High)
CWE
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SMCI | MBD-X12SPI |
Affected:
01.07.20
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"BMC"
],
"product": "MBD-X12SPI",
"vendor": "SMCI",
"versions": [
{
"status": "affected",
"version": "01.07.20",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "runZero"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges."
}
],
"value": "A logic flaw in the BMC IPMI implementation may allow an attacker to send specially crafted RAKP+ messages and escalate an account to administrator privileges."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233: Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269: Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T08:02:49.783Z",
"orgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"shortName": "Supermicro"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Supermicro BMC IPMI feature contains a Privilege escalation vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"assignerShortName": "Supermicro",
"cveId": "CVE-2026-65220",
"datePublished": "2026-10-27T08:02:49.783Z",
"dateReserved": "2026-07-21T20:14:40.864Z",
"dateUpdated": "2026-10-27T08:02:49.783Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-65219 (GCVE-0-2026-65219)
Vulnerability from cvelistv5 – Published: 2026-10-27 07:57 – Updated: 2026-10-27 07:57
VLAI
EPSS
VEX
Title
Supermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerability
Summary
A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands.
Severity
7.4 (High)
CWE
- CWE-696 - Incorrect Behavior Order
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SMCI | MBD-X12SPI |
Affected:
1.07.20
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"BMC"
],
"product": "MBD-X12SPI",
"vendor": "SMCI",
"versions": [
{
"status": "affected",
"version": "1.07.20",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "runZero"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands."
}
],
"value": "A flaw in the BMC RAKP+ implementation may allow an attacker to send a request followed by a specially crafted RAKP message and establish an RMCP+ session, which could then be used to execute commands."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115: Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-696",
"description": "CWE-696: Incorrect Behavior Order",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T07:57:12.003Z",
"orgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"shortName": "Supermicro"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Supermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"assignerShortName": "Supermicro",
"cveId": "CVE-2026-65219",
"datePublished": "2026-10-27T07:57:12.003Z",
"dateReserved": "2026-07-21T20:14:40.863Z",
"dateUpdated": "2026-10-27T07:57:12.003Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18451 (GCVE-0-2026-18451)
Vulnerability from cvelistv5 – Published: 2026-10-27 07:51 – Updated: 2026-10-27 07:51
VLAI
EPSS
VEX
Title
Supermicro BMC's iKVM feature is vulnerable to KVM session hijacking due to a predictable time-seeded launch token
Summary
The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session.
Severity
CWE
- CWE-337 - Predictable Seed in a Pseudo-Random Number Generator (PRNG)
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| SMCI | MBD-X12SPI |
Affected:
01.07.20
(custom)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"BMC"
],
"product": "MBD-X12SPI",
"vendor": "SMCI",
"versions": [
{
"status": "affected",
"version": "01.07.20",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "runZero"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session."
}
],
"value": "The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session."
}
],
"impacts": [
{
"capecId": "CAPEC-59",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-59: Session Hijacking"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.1,
"baseSeverity": "LOW",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-337",
"description": "CWE-337: Predictable Seed in a Pseudo-Random Number Generator (PRNG)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T07:51:10.336Z",
"orgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"shortName": "Supermicro"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Supermicro BMC\u0027s iKVM feature is vulnerable to KVM session hijacking due to a predictable time-seeded launch token",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"assignerShortName": "Supermicro",
"cveId": "CVE-2026-18451",
"datePublished": "2026-10-27T07:51:10.336Z",
"dateReserved": "2026-07-31T05:37:17.153Z",
"dateUpdated": "2026-10-27T07:51:10.336Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}