Search
Find a vulnerability
Search criteria
4 vulnerabilities found for X12SPI by SMCI
CVE-2026-18450 (GCVE-0-2026-18450)
Vulnerability from nvd – Published: 2026-10-27 07:46 – Updated: 2026-10-27 07:46
VLAI
EPSS
VEX
Title
Supermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerability
Summary
The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.
Severity
9.8 (Critical)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"BMC"
],
"product": "X12SPI",
"vendor": "SMCI",
"versions": [
{
"status": "affected",
"version": "01.07.20",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "runZero"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session."
}
],
"value": "The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115: Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T07:46:02.598Z",
"orgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"shortName": "Supermicro"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Supermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"assignerShortName": "Supermicro",
"cveId": "CVE-2026-18450",
"datePublished": "2026-10-27T07:46:02.598Z",
"dateReserved": "2026-07-31T05:37:15.403Z",
"dateUpdated": "2026-10-27T07:46:02.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18449 (GCVE-0-2026-18449)
Vulnerability from nvd – Published: 2026-10-27 07:32 – Updated: 2026-10-27 07:32
VLAI
EPSS
VEX
Title
Supermicro BMC contains a SMCRAKP Fixed Key vulnerability
Summary
The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.
Severity
7.5 (High)
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
1 reference
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"BMC"
],
"product": "X12SPI",
"vendor": "SMCI",
"versions": [
{
"status": "affected",
"version": "01.07.20",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "runZero"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session."
}
],
"value": "The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37: Retrieve Embedded Credentials"
}
]
},
{
"capecId": "CAPEC-97",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-97: Cryptanalysis"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798: Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T07:32:36.594Z",
"orgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"shortName": "Supermicro"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Supermicro BMC contains a SMCRAKP Fixed Key vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"assignerShortName": "Supermicro",
"cveId": "CVE-2026-18449",
"datePublished": "2026-10-27T07:32:36.594Z",
"dateReserved": "2026-07-31T05:37:13.707Z",
"dateUpdated": "2026-10-27T07:32:36.594Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18450 (GCVE-0-2026-18450)
Vulnerability from cvelistv5 – Published: 2026-10-27 07:46 – Updated: 2026-10-27 07:46
VLAI
EPSS
VEX
Title
Supermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerability
Summary
The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.
Severity
9.8 (Critical)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
1 reference
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"BMC"
],
"product": "X12SPI",
"vendor": "SMCI",
"versions": [
{
"status": "affected",
"version": "01.07.20",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "runZero"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session."
}
],
"value": "The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115: Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T07:46:02.598Z",
"orgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"shortName": "Supermicro"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Supermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"assignerShortName": "Supermicro",
"cveId": "CVE-2026-18450",
"datePublished": "2026-10-27T07:46:02.598Z",
"dateReserved": "2026-07-31T05:37:15.403Z",
"dateUpdated": "2026-10-27T07:46:02.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18449 (GCVE-0-2026-18449)
Vulnerability from cvelistv5 – Published: 2026-10-27 07:32 – Updated: 2026-10-27 07:32
VLAI
EPSS
VEX
Title
Supermicro BMC contains a SMCRAKP Fixed Key vulnerability
Summary
The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.
Severity
7.5 (High)
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
1 reference
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"BMC"
],
"product": "X12SPI",
"vendor": "SMCI",
"versions": [
{
"status": "affected",
"version": "01.07.20",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "runZero"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session."
}
],
"value": "The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37: Retrieve Embedded Credentials"
}
]
},
{
"capecId": "CAPEC-97",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-97: Cryptanalysis"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798: Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T07:32:36.594Z",
"orgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"shortName": "Supermicro"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Supermicro BMC contains a SMCRAKP Fixed Key vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"assignerShortName": "Supermicro",
"cveId": "CVE-2026-18449",
"datePublished": "2026-10-27T07:32:36.594Z",
"dateReserved": "2026-07-31T05:37:13.707Z",
"dateUpdated": "2026-10-27T07:32:36.594Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}