PT-2023-5858 · Supermicro · Supermicro X11 Series

Published 2023-08-17 · Updated 2025-06-18 · CVE-2023-40286

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Supermicro X11 series versions 1.66

Description The issue exists due to the lack of protection for the web page structure in the web interface of Supermicro X11 series BMC IPMI servers. This allows a remote attacker to exploit an XSS issue and potentially execute arbitrary code. An attacker could exploit this issue on affected devices, including Supermicro X11SSM-F, X11SAE-F, and X11SSE-F.

Recommendations For Supermicro X11 series version 1.66, consider disabling the web interface until a patch is available to prevent exploitation of the XSS issue. Restrict access to the web interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-06545

CVE-2023-40286

Affected Products

Supermicro X11 Series

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2023-40286 · Security Note
• https://bdu.fstec.ru/vul/2023-06545 · Security Note
• https://supermicro.com/en/support/security_BMC_IPMI_Oct_2023 · Vendor Advisory
• https://supermicro.com/en/support/security_center#%21advisories · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-40286 · Vendor Advisory
• https://thehackernews.com/2023/10/supermicros-bmc-firmware-found.html · Note
• https://cybersecurity-help.cz/vdb/SB2023100644 · Note
• https://twitter.com/matrosov/status/1692279002139091390 · Twitter Post
• https://twitter.com/reviewpunk/status/1710523314462953979 · Twitter Post
• https://t.me/cvenotify/74763 · Telegram Post
• https://twitter.com/CVEnew/status/1772830801815839066 · Twitter Post
• https://t.me/cvenotify/126096 · Telegram Post
• https://binarly.io/advisories/BRLY-2023-012/index.html · Note