PT-2023-8803 · Supermicro · Supermicro X11

Published 2023-12-07 · Updated 2024-01-19 · CVE-2023-33412

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Supermicro X11 and M11 based devices versions prior to 3.17.02

Description The web interface in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation allows remote authenticated users to execute arbitrary commands via a crafted request targeting vulnerable cgi endpoints. This issue is related to insufficient input validation.

Recommendations For versions prior to 3.17.02, update the firmware to version 3.17.02 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable cgi endpoints until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-01956

CVE-2023-33412

Affected Products

Supermicro X11

References · 10

• https://supermicro.com/en/support/security_BMC_Dec_2023 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-33412 · Security Note
• https://bdu.fstec.ru/vul/2024-01956 · Security Note
• https://osv.dev/vulnerability/CVE-2023-33412 · Vendor Advisory
• http://supermicro.com · Note
• https://t.me/cvenotify/63431 · Telegram Post
• https://vuldb.com/ru/?id.247187 · Note
• https://twitter.com/VulmonFeeds/status/1732849188331815374 · Twitter Post
• https://twitter.com/CVEnew/status/1732814732770292216 · Twitter Post
• https://twitter.com/PSuiteNetwork/status/1748453123633357014 · Twitter Post