Supermicro · the BMC layer
PWX for Supermicro BMC
Supermicro BMC: the known vulnerabilities of its firmware, how to give a scanner read-only access, and the settings to check. Free, no account.
The BMC is one layer of PWX, which covers the stack from the tenant and its VMs to the host, BMC, CPU, GPU and TPU. See every layer
18 CVEs4 critical11 high0 exploited (KEV)
1. Known vulnerabilities
| CVE | Severity | Published | Summary |
|---|---|---|---|
| CVE-2026-3821 | high 8.8 | 2026-07-22 | Supermicro (SMC) SMASH services contain an Arbitrary code execution issue in X14DBG-DAP and X14DBI. An authorized attacker can exploit SMASH’s input capability to compromise data integrity or launch a Denial-of-Servic... |
| CVE-2026-3820 | high 7.2 | 2026-06-04 | There is a vulnerability in the Supermicro BMC SMTP service at Supermicro AS-2115HS-TNR. An attacker may obtain administrator privileges and inject specially crafted characters into the SMTP service configuration. T... |
| CVE-2025-12007 | high 8.4 | 2026-01-16 | There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X13SEM-F . An attacker can update the system firmware with a specially crafted image. |
| CVE-2025-12006 | high 7.2 | 2026-01-16 | There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X12STW-F . An attacker can update the system firmware with a specially crafted image. |
| CVE-2025-8727 | high 7.2 | 2025-11-18 | There is a vulnerability in the Supermicro BMC web function at Supermicro MBD-X13SEDW-F. After logging into the BMC Web server, an attacker can use a specially crafted payload to trigger the Stack buffer overflow vuln... |
| CVE-2025-8404 | medium 5.5 | 2025-11-18 | Stack buffer overflow vulnerability exists in the Supermicro BMC Shared library. An authenticated attacker with access to the BMC exploit stack buffer via a crafted header and achieve arbitrary code execution of the ... |
| CVE-2025-8076 | high 7.2 | 2025-11-18 | There is a vulnerability in the Supermicro BMC web function at Supermicro MBD-X13SEDW-F. After logging into the BMC Web server, an attacker can use a specially crafted payload to trigger the Stack buffer overflow vuln... |
| CVE-2025-7704 | medium 5.4 | 2025-11-13 | Supermicro BMC Insyde SMASH shell program has a stacked-based overflow vulnerability |
| CVE-2025-7937 | high 7.2 | 2025-09-19 | There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X12STW . An attacker can update the system firmware with a specially crafted image. |
| CVE-2025-6198 | high 7.2 | 2025-09-19 | There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X13SEM-F . An attacker can update the system firmware with a specially crafted image. |
| CVE-2024-10237 | high 7.2 | 2025-02-04 | There is a vulnerability in the BMC firmware image authentication design at Supermicro MBD-X12DPG-OA6 . An attacker can modify the firmware to bypass BMC inspection and bypass the signature verification process |
| CVE-2024-36435 | critical 9.8 | 2024-07-11 | An issue was discovered on Supermicro BMC firmware in select X11, X12, H12, B12, X13, H13, and B13 motherboards (and CMM6 modules). An unauthenticated user can post crafted data to the interface that triggers a stack ... |
| CVE-2023-40289 | high 7.2 | 2024-03-27 | A command injection issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker can exploit this to elevate privileges from a user with BMC administrative privileges. |
| CVE-2023-35861 | critical 9.8 | 2023-07-31 | A shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before 03.10.35) allows remote attackers to inject execute arbitrary commands as root on the BMC. |
| CVE-2022-43309 | medium 5.5 | 2023-04-07 | Supermicro X11SSL-CF HW Rev 1.01, BMC firmware v1.63 was discovered to contain insecure permissions. |
| CVE-2019-16650 | critical 10 | 2019-09-21 | On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number. In opportunistic circumstances, an attacker can simply c... |
| CVE-2019-16649 | critical 10 | 2019-09-21 | On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of BMC credentials and data transferred over virtual media de... |
| CVE-2013-4782 | high 10 | 2013-07-08 | The Supermicro BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary password. |
Source: NVD, NVD CVE API 2.0: keyword "Supermicro BMC", refreshed 2026-10-29 09:17 UTC. EXPLOITED = listed in the CISA KEV catalog.
2. Give a scanner read-only access
- Redfish:
POST /redfish/v1/AccountService/Accountswith{"UserName":"pwx-ro","Password":"<long random>","RoleId":"ReadOnly","Enabled":true}. Allowed RoleIds: Administrator, Operator, ReadOnly. - SMCIPMITool:
user add <ID> pwx-ro <password> 2(2 = User, the read-level privilege; passwords 8 to 19 characters). - Web interface: the read-level role is called User (X13/H13 manual).
- Gen 13 BMC firmware 01.05.xx and later keeps IPMI and Redfish accounts apart (
AccountTypes, default Redfish): create the account for the interface the scanner uses. Supermicro advises not to preserve users when updating to that firmware.
Sources: Supermicro Redfish user guide: account service · Redfish user guide: accounts (Gen 13) · SMCIPMITool user guide · X13/H13 BMC manual
3. Settings that open the power path
From Supermicro's BMC security best practices:
- Account lockout configured (
AccountService AccountLockoutThresholdandAccountLockoutDuration). - UDP 623 (IPMI) and TCP 5900 (KVM) blocked from untrusted networks; the BMC on a separate management network.
- Default password changed, System Lockdown on, IP Access Policy configured.
Sources: Supermicro: Best Practices for Managing Servers with IPMI/BMC Security · Supermicro BMC virtual media advisory
Standard Redfish checks
| Redfish property | Want | Why |
|---|---|---|
| NetworkProtocol IPMI.ProtocolEnabled | false | IPMI 2.0 RAKP leaks password hashes to anyone who can reach the port (CVE-2013-4786). |
| NetworkProtocol Telnet.ProtocolEnabled | false | Credentials and commands travel in clear text. |
| NetworkProtocol HTTP.ProtocolEnabled | false | The web and Redfish interface is reachable without TLS. |
| NetworkProtocol SNMP.EnableSNMPv1 / EnableSNMPv2c | false (SNMPv3 only) | No authentication beyond a clear-text community string. |
| AccountService AccountLockoutThreshold | greater than 0 | With 0, BMC passwords can be guessed without limit. |
| HostInterface AuthenticationModes | no AuthNone | AuthNone lets any process on the host drive the BMC, and through it the power path, without credentials. |
| HostInterface CredentialBootstrapping.Enabled | false | The host OS can mint its own BMC account at any time. |
| Accounts with RoleId Administrator | one break-glass account | Each administrator can rewrite the power path. |
The Redfish Inspector checks each of these for you.
Vendor security advisories: www.supermicro.com/en/support/security_center. New CVEs also appear in PWX news.
4. Check it
- One BMC, in your browser: collect its Redfish answers and paste them into the Redfish Inspector. On Supermicro BMC the manager is usually
/redfish/v1/Managers/1. - All of them, from one machine that reaches the BMC network:
Every request is a GET and is written to a log next to the result. Nothing is sent anywhere else.curl -fsSL https://get.bareket.ai/pgdiscover | sh pgdiscover up 10.0.7.0/24 --credentials pwx-ro.cred --insecure - See what continuous monitoring adds: the Stack sandbox.
Free e-mail alerts
Get an e-mail when a new CVE lands for what you run
Run it on your own fleet
PWX Discover is free: the scan reads your fleet and lists what to fix, on your machine. PWX Monitor keeps watching every layer, from the tenant to the power rail, with attack paths and alerts in your SIEM. PWX Protect acts on the BMC. Start with a pilot.