Refine your search
2 vulnerabilities found for X12SPI by SMCI
CVE-2026-18450 (GCVE-0-2026-18450)
Vulnerability from cvelistv5
Published
2026-10-27 07:46
Modified
2026-10-27 07:46
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-306 - Missing Authentication for Critical Function
Summary
The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.
References
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"BMC"
],
"product": "X12SPI",
"vendor": "SMCI",
"versions": [
{
"status": "affected",
"version": "01.07.20",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "runZero"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session."
}
],
"value": "The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session."
}
],
"impacts": [
{
"capecId": "CAPEC-115",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-115: Authentication Bypass"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306: Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T07:46:02.598Z",
"orgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"shortName": "Supermicro"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Supermicro BMC contains Unprotected IPMI Commands Accepted on Active RMCP+ Sessions vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"assignerShortName": "Supermicro",
"cveId": "CVE-2026-18450",
"datePublished": "2026-10-27T07:46:02.598Z",
"dateReserved": "2026-07-31T05:37:15.403Z",
"dateUpdated": "2026-10-27T07:46:02.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-18449 (GCVE-0-2026-18449)
Vulnerability from cvelistv5
Published
2026-10-27 07:32
Modified
2026-10-27 07:32
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-798 - Use of Hard-coded Credentials
Summary
The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session.
References
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "affected",
"platforms": [
"BMC"
],
"product": "X12SPI",
"vendor": "SMCI",
"versions": [
{
"status": "affected",
"version": "01.07.20",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "runZero"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session."
}
],
"value": "The BMC does not correctly enforce integrity and encryption requirements for IPMI commands. An attacker may be able to craft packets that execute arbitrary commands on an active session."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37: Retrieve Embedded Credentials"
}
]
},
{
"capecId": "CAPEC-97",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-97: Cryptanalysis"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798: Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T07:32:36.594Z",
"orgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"shortName": "Supermicro"
},
"references": [
{
"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Supermicro BMC contains a SMCRAKP Fixed Key vulnerability",
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"cveMetadata": {
"assignerOrgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
"assignerShortName": "Supermicro",
"cveId": "CVE-2026-18449",
"datePublished": "2026-10-27T07:32:36.594Z",
"dateReserved": "2026-07-31T05:37:13.707Z",
"dateUpdated": "2026-10-27T07:32:36.594Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}