PT-2025-1580 · Supermicro · Supermicro Mbd-X12Dpg-Oa6

Alexander Tereshkin · Published 2025-02-04 · Updated 2025-09-25 · CVE-2024-10237

Positive Technologies · (AI Summary)

CVSS v3.1

7.2

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

**Name of the Vulnerable Software and Affected Versions**

Supermicro BMC firmware versions (affected versions not specified)

**Description**

The Baseboard Management Controller (BMC) firmware has a flaw in its firmware image authentication design. An attacker can modify the firmware to bypass BMC inspection and the signature verification process. This allows for unauthorized modifications to the BMC firmware.

**Recommendations**

At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Verification of Cryptographic Signature

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-347

CWE-345

Related Identifiers

CVE-2024-10237

Affected Products

Supermicro Mbd-X12Dpg-Oa6

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2024-10237 · Security Note
• https://twitter.com/binarly_io/status/1970610777624358990 · Twitter Post
• https://supermicro.com/en/support/security_BMC_IPMI_Jan_2025 · Note
• https://twitter.com/matrosov/status/1940903113051066561 · Twitter Post
• https://t.me/cvenotify/109811 · Telegram Post
• https://t.me/purp_sec/1150 · Telegram Post
• https://twitter.com/CVEnew/status/1886690684377375110 · Twitter Post
• https://twitter.com/TweetThreatNews/status/1970951359848456583 · Twitter Post
• https://t.me/true_secator/7461 · Telegram Post
• https://twitter.com/binarly_io/status/1970554551507042315 · Twitter Post
• https://twitter.com/binarly_io/status/1940442925462405297 · Twitter Post