Supermicro vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2024-36434 An SMM callout vulnerability was discovered in Supermicro X11DPH-T, X11DPH-Tq, and X11DPH-i motherboards with BIOS firmware before 4.4.High 7.5 · Jul 15, 2024
• CVE-2024-36433 An arbitrary memory write vulnerability was discovered in Supermicro X11DPH-T, X11DPH-Tq, and X11DPH-i motherboards with BIOS firmware before 4.4.High 7.5 · Jul 15, 2024
• CVE-2024-36432 An arbitrary memory write vulnerability was discovered in Supermicro X11DPG-HGX2, X11PDG-QT, X11PDG-OT, and X11PDG-SN motherboards with BIOS firmware before 4.4High 7.5 · Jul 15, 2024
• CVE-2024-36435 An issue was discovered on Supermicro BMC firmware in select X11, X12, H12, B12, X13, H13, and B13 motherboards (and CMM6 modules).Critical 9.8 · Jul 11, 2024
• CVE-2023-40290 An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices.High 8.3 · Mar 27, 2024
• CVE-2023-40289 A command injection issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices.High 7.2 · Mar 27, 2024
• CVE-2023-40288 An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices.High 8.3 · Mar 27, 2024
• CVE-2023-40287 An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices.High 8.3 · Mar 27, 2024
• CVE-2023-40286 An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices.High 8.3 · Mar 27, 2024
• CVE-2023-40284 An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices.High 8.3 · Mar 27, 2024
• CVE-2023-33413 The configuration functionality in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 aHigh 8.8 · Dec 7, 2023
• CVE-2023-33412 The web interface in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based dHigh 8.8 · Dec 7, 2023
• CVE-2023-33411 A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based deviceHigh 7.5 · Dec 7, 2023
• CVE-2023-34853 Buffer Overflow vulnerability in Supermicro motherboard X12DPG-QR 1.4b allows local attackers to hijack control flow via manipulation of SmcSecurityEraseSetupVaHigh 7.8 · Aug 22, 2023
• CVE-2023-35861 A shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before 03.10.35) allows remote attackers to inject execute aCritical 9.8 · Jul 31, 2023
• CVE-2020-15046 The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 allows remote attackers to exploit a cgi/config_user.cgi CSRF issuHigh 8.8 · Jun 24, 2020
• CVE-2013-3620 Hardcoded WSMan credentials in Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before 3.15 (SMT_X9_315)High 7.5 · Jan 2, 2020
• CVE-2013-3619 Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before SMT_X9_317 and firmware for Supermicro X8 generaHigh 8.1 · Jan 2, 2020
• CVE-2019-19642 On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who High 8.8 · Dec 7, 2019
• CVE-2019-16650 On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number.Critical 10 · Sep 20, 2019
• CVE-2019-16649 On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of BCritical 10 · Sep 20, 2019
• CVE-2019-13131 Super Micro SuperDoctor 5, when restrictions are not implemented in agent.cfg, allows remote attackers to execute arbitrary commands via NRPE.Critical 9.8 · Jul 1, 2019
• CVE-2013-3623 Multiple stack-based buffer overflows in cgi/close_window.cgi in the web interface in the Intelligent Platform Management Interface (IPMI) with firmware before High 10 · Dec 10, 2013
• CVE-2013-3622 Buffer overflow in logout.cgi in the Intelligent Platform Management Interface (IPMI) with firmware before 3.15 (SMT_X9_315) on Supermicro X9 generation motherbHigh 9 · Dec 10, 2013
• CVE-2013-3609 The web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SIHigh 10 · Sep 7, 2013