CVE-2026-3820
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
A vulnerability in the Supermicro BMC SMTP service on model AS-2115HS-TNR allows an attacker to gain administrator privileges and inject specially crafted characters into the SMTP configuration, potentially causing unintended command execution during process invocation.
Risk Assessment
Impacts may include denial-of-service, arbitrary code execution, or permanent compromise of the BMC controller, threatening the entire server infrastructure.
Recommendation
Contact the vendor for a patch and restrict access to the BMC interface.
Other vulnerabilities in Supermicro BMC
See all- CVE-2023-33412High
A vulnerability in the web interface of the BMC (IPMI) on Supermicro X11 and M11 devices with firmware versions before 3.17.02 allows remote authenticated users to execute arbitrary commands via a crafted request targeting vulnerable CGI endpoints.
- CVE-2023-33411High
A web server in the BMC (IPMI) implementation on Supermicro X11 and M11 devices with firmware up to 3.17.02 allows remote unauthenticated attackers to perform directory traversal, potentially disclosing sensitive information.
Original NVD description (English source)
There is a vulnerability in the Supermicro BMC SMTP service at Supermicro AS-2115HS-TNR. An attacker may obtain administrator privileges and inject specially crafted characters into the SMTP service configuration. This may cause the underlying system to execute unintended commands during process invocation. Potential impact includes denial-of-service attacks, arbitrary code execution, or permanent compromise of the controller.