supermicro Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/supermicro/ Sun, 26 Feb 2023 06:46:07 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png supermicro Archives - CVE Vulnerability https://cvevulnerability.com/cve_products/supermicro/ 32 32 CVE-2018-13787 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-13787/ Sun, 26 Feb 2023 06:46:07 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-13787/ Certain Supermicro X11S, X10, X9, X8SI, K1SP, C9X299, C7, B1, A2, and A1 products have a misconfigured Descriptor Region, allowing OS programs to modify firmware.

The post CVE-2018-13787 appeared first on CVE Vulnerability.

]]> Certain Supermicro X11S, X10, X9, X8SI, K1SP, C9X299, C7, B1, A2, and A1 products have a misconfigured Descriptor Region, allowing OS programs to modify firmware.

The post CVE-2018-13787 appeared first on CVE Vulnerability.

]]> CVE-2020-15046 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-15046/ Sun, 26 Feb 2023 06:37:40 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-15046/ The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 allows remote attackers to exploit a cgi/config_user.cgi CSRF issue to add new admin users. The fixed versions are BIOS 3.2 and firmware 03.88.

The post CVE-2020-15046 appeared first on CVE Vulnerability.

]]> The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 allows remote attackers to exploit a cgi/config_user.cgi CSRF issue to add new admin users. The fixed versions are BIOS 3.2 and firmware 03.88.

The post CVE-2020-15046 appeared first on CVE Vulnerability.

]]> CVE-2019-19642 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-19642/ Sun, 26 Feb 2023 06:32:09 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-19642/ On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who can send HTTP requests to the IPMI IP address. This requires a POST to /rpc/setvmdrive.asp with shell metacharacters in ShareHost or ShareName. The attacker can achieve a persistent backdoor.

The post CVE-2019-19642 appeared first on CVE Vulnerability.

]]> On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who can send HTTP requests to the IPMI IP address. This requires a POST to /rpc/setvmdrive.asp with shell metacharacters in ShareHost or ShareName. The attacker can achieve a persistent backdoor.

The post CVE-2019-19642 appeared first on CVE Vulnerability.

]]> CVE-2019-16649 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-16649/ Sun, 26 Feb 2023 06:31:18 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-16649/ On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of BMC credentials and data transferred over virtual media devices. Attackers can use captured credentials to connect virtual USB devices to the server managed by the BMC.

The post CVE-2019-16649 appeared first on CVE Vulnerability.

]]> On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of BMC credentials and data transferred over virtual media devices. Attackers can use captured credentials to connect virtual USB devices to the server managed by the BMC.

The post CVE-2019-16649 appeared first on CVE Vulnerability.

]]> CVE-2019-16650 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-16650/ Sun, 26 Feb 2023 06:31:18 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-16650/ On Supermicro X10 and X11 products, a client’s access privileges may be transferred to a different client that later has the same socket file descriptor number. In opportunistic circumstances, an attacker can simply connect to the virtual media service, and then connect virtual USB devices to the server managed by the BMC.

The post CVE-2019-16650 appeared first on CVE Vulnerability.

]]> On Supermicro X10 and X11 products, a client’s access privileges may be transferred to a different client that later has the same socket file descriptor number. In opportunistic circumstances, an attacker can simply connect to the virtual media service, and then connect virtual USB devices to the server managed by the BMC.

The post CVE-2019-16650 appeared first on CVE Vulnerability.

]]> CVE-2021-22887 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-22887/ Thu, 23 Feb 2023 14:07:25 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-22887/ A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to compromise BIOS firmware. This vulnerability can be exploited only as part of an attack chain. Before an attacker can compromise the BIOS, they must exploit the device.

The post CVE-2021-22887 appeared first on CVE Vulnerability.

]]> A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to compromise BIOS firmware. This vulnerability can be exploited only as part of an attack chain. Before an attacker can compromise the BIOS, they must exploit the device.

The post CVE-2021-22887 appeared first on CVE Vulnerability.

]]>