PT-2023-25350 · Supermicro · Supermicro Motherboards

Freax13 · Publicado 2023-07-31 · Atualizado 2023-08-07 · CVE-2023-35861

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Supermicro motherboards versions prior to 03.10.35

Description A shell-injection vulnerability in email notifications on Supermicro motherboards allows remote attackers to inject and execute arbitrary commands as root on the BMC.

Recommendations For versions prior to 03.10.35, update to version 03.10.35 or later to resolve the issue. As a temporary workaround, consider disabling email notifications on the BMC until a patch is available. Restrict access to the BMC to minimize the risk of exploitation.

Exploit

Correção

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2023-35861

Produtos afetados

Supermicro Motherboards

Referências · 7

• 🔥 https://blog.freax13.de/cve/cve-2023-35861 · Exploit
• https://supermicro.com/en/support/security_SMTP_Jun_2023 · Aviso do Fabricante
• https://t.me/cvenotify/55559 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-35861 · Nota de Segurança
• https://t.me/cibsecurity/67449 · Publicação no Telegram
• https://supermicro.com/en/products/motherboards · Nota
• https://osv.dev/vulnerability/CVE-2023-35861 · Aviso do Fabricante