PT-2023-24338 · Supermicro · Supermicro X11

Published 2023-12-07 · Updated 2024-01-19 · CVE-2023-33413

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Supermicro X11 and M11 based devices versions through 3.17.02

Description The configuration functionality in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation allows remote authenticated users to execute arbitrary commands. IPMI BMC devices use hardcoded configuration file encryption keys, allowing an attacker to craft and upload a malicious configuration file package to gain remote command execution.

Recommendations For versions through 3.17.02, consider disabling the configuration functionality in the IPMI BMC implementation until a patch is available. Restrict access to the configuration file upload feature to minimize the risk of exploitation. Avoid using the hardcoded configuration file encryption keys in the affected devices until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2023-33413

Affected Products

Supermicro X11

References · 8

• https://supermicro.com/en/support/security_BMC_Dec_2023 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-33413 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33413 · Security Note
• https://twitter.com/CVEnew/status/1732814733940543556 · Twitter Post
• http://supermicro.com · Note
• https://twitter.com/PSuiteNetwork/status/1748453208370917424 · Twitter Post
• https://t.me/cvenotify/63432 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1732849441390870798 · Twitter Post