PT-2020-14142 · Supermicro · Supermicro X10Drh-It

Published 2020-06-24 · Updated 2024-02-14 · CVE-2020-15046

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Supermicro X10DRH-iT motherboards with BIOS version 2.0a and IPMI firmware version 03.40

Description The issue allows remote attackers to exploit a CSRF problem in the cgi/config user.cgi file through the web interface, enabling them to add new admin users.

Recommendations For Supermicro X10DRH-iT motherboards with BIOS version 2.0a and IPMI firmware version 03.40, update the BIOS to version 3.2 and the IPMI firmware to version 03.88.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-15046

Affected Products

Supermicro X10Drh-It

References · 7

• 🔥 http://packetstormsecurity.com/files/158373/SuperMicro-IPMI-03.40-Cross-Site-Request-Forgery.html · Exploit
• 🔥 https://exploit-db.com/exploits/48668 · Exploit
• 🔥 https://totalpentest.com/post/supermicro-ipmi-webgui-cross-site-request-forgery · Exploit
• 🔥 https://exploit-db.com/exploits/48652 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-15046 · Security Note
• https://osv.dev/vulnerability/CVE-2020-15046 · Vendor Advisory
• https://t.me/cybersecuritytechnologies/1395 · Telegram Post