PT-2023-25350 · Supermicro · Supermicro Motherboards

Freax13 · Published 2023-07-31 · Updated 2023-08-07 · CVE-2023-35861

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Supermicro motherboards versions prior to 03.10.35

Description A shell-injection vulnerability in email notifications on Supermicro motherboards allows remote attackers to inject and execute arbitrary commands as root on the BMC.

Recommendations For versions prior to 03.10.35, update to version 03.10.35 or later to resolve the issue. As a temporary workaround, consider disabling email notifications on the BMC until a patch is available. Restrict access to the BMC to minimize the risk of exploitation.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2023-35861

Affected Products

Supermicro Motherboards

References · 7

• 🔥 https://blog.freax13.de/cve/cve-2023-35861 · Exploit
• https://supermicro.com/en/support/security_SMTP_Jun_2023 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-35861 · Security Note
• https://osv.dev/vulnerability/CVE-2023-35861 · Vendor Advisory
• https://t.me/cvenotify/55559 · Telegram Post
• https://t.me/cibsecurity/67449 · Telegram Post
• https://supermicro.com/en/products/motherboards · Note