CVE-2023-33411
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk67th percentile - higher than 67% of all known CVEs
Summary
A web server in the BMC (IPMI) implementation on Supermicro X11 and M11 devices with firmware up to 3.17.02 allows remote unauthenticated attackers to perform directory traversal, potentially disclosing sensitive information.
Risk Assessment
The risk involves remote unauthenticated attackers reading sensitive system files, potentially leading to exposure of configuration data, passwords, or other organizational secrets.
Recommendation
Immediately update the BMC firmware to a version newer than 3.17.02 and restrict access to the IPMI interface to trusted networks only.
Other vulnerabilities in Supermicro BMC
See all- CVE-2026-3820High
A vulnerability in the Supermicro BMC SMTP service on model AS-2115HS-TNR allows an attacker to gain administrator privileges and inject specially crafted characters into the SMTP configuration, potentially causing unintended command execution during process invocation.
- CVE-2023-33412High
A vulnerability in the web interface of the BMC (IPMI) on Supermicro X11 and M11 devices with firmware versions before 3.17.02 allows remote authenticated users to execute arbitrary commands via a crafted request targeting vulnerable CGI endpoints.
Original NVD description (English source)
A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions up to 3.17.02, allows remote unauthenticated users to perform directory traversal, potentially disclosing sensitive information.