CVE-2023-33412
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk63th percentile - higher than 63% of all known CVEs
Summary
A vulnerability in the web interface of the BMC (IPMI) on Supermicro X11 and M11 devices with firmware versions before 3.17.02 allows remote authenticated users to execute arbitrary commands via a crafted request targeting vulnerable CGI endpoints.
Risk Assessment
The risk involves potential full compromise of the BMC by an authenticated attacker, leading to integrity and confidentiality breaches of managed hardware and possible attacks on the IT infrastructure.
Recommendation
Immediately update the BMC firmware to version 3.17.02 or later and restrict access to the BMC web interface to trusted networks only.
Other vulnerabilities in Supermicro BMC
See all- CVE-2026-3820High
A vulnerability in the Supermicro BMC SMTP service on model AS-2115HS-TNR allows an attacker to gain administrator privileges and inject specially crafted characters into the SMTP configuration, potentially causing unintended command execution during process invocation.
- CVE-2023-33411High
A web server in the BMC (IPMI) implementation on Supermicro X11 and M11 devices with firmware up to 3.17.02 allows remote unauthenticated attackers to perform directory traversal, potentially disclosing sensitive information.
Original NVD description (English source)
The web interface in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions before 3.17.02, allows remote authenticated users to execute arbitrary commands via a crafted request targeting vulnerable cgi endpoints.