PT-2020-7452 · Supermicro · Supermicro X9+1

Published 2020-01-02 · Updated 2020-01-14 · CVE-2013-3620

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Supermicro X9 generation motherboards versions prior to 3.15 (SMT X9 315) Supermicro X8 generation motherboards versions prior to SMT X8 312

Description: The issue concerns hardcoded WSMan credentials in the Intelligent Platform Management Interface (IPMI) with firmware for certain Supermicro motherboards. This could potentially allow unauthorized access.

Recommendations: For Supermicro X9 generation motherboards versions prior to 3.15 (SMT X9 315), update the firmware to version 3.15 (SMT X9 315) or later. For Supermicro X8 generation motherboards versions prior to SMT X8 312, update the firmware to SMT X8 312 or later.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2013-3620

Affected Products

Supermicro X8

Supermicro X9

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2013-3620 · Security Note
• https://supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89045 · Note
• https://support.citrix.com/article/CTX216642 · Note
• https://t.me/cibsecurity/8954 · Telegram Post
• http://support.citrix.com/article/CTX216642 · Note
• https://community.rapid7.com/community/metasploit/blog/2013/11/05/supermicro-ipmi-firmware-vulnerabilities · Note