Supermicro X14 Command Injection

Executive summary #

The Supermicro OEM out-of-band file-apply handler on X14 parses an uploaded XML document and passes the MacAddr element's value attribute to the MAC-setting routine without any validation, quoting, or escaping. That routine appends the value verbatim to the shell command /sbin/fw_setenv macaddr <value> (and a second, ethaddr) and runs it through popen. An authenticated IPMI Administrator who drives the OEM file-upload chain can therefore place a shell command substitution in the attribute value and execute arbitrary commands as the operating system root user on the BMC. This vulnerability has an estimated CVSSv3.1 score of CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H (6.6, Medium), and is an instance of CWE-78 (Improper Neutralization of Special Elements used in an OS Command).

Technical details #

The vulnerable path is part of the X14 OEM out-of-band file-apply flow. When an uploaded XML file is processed by the restore handler, its MacAddr value is passed to the MAC-setting routine without validation or shell escaping. The routine incorporates that value into commands used to set the BMC's MAC addresses and executes them through a shell as root. An authenticated IPMI Administrator able to invoke this file-apply action can therefore cause arbitrary command execution on the BMC. The apply operation runs asynchronously, so the IPMI response does not itself indicate whether processing has completed.

Attacker value #

This issue can allow an authenticated administrator to execute commands as the operating system root user on the BMC. Root execution is a total compromise of the BMC operating system and is a boundary beyond the intended IPMI management role. The precondition is an Administrator IPMI session, which the out-of-band file chain requires before it dispatches the apply action to the vulnerable handler.

Credit #

This issue was discovered by HD Moore with the help of AI tools. Disclosure was coordinated by Tod Beardsley.

Timeline #

• 2026-08-22 (Sat): Initial findings discovered and documented
• 2026-07-21 (Tue): CVE-2026-65213 reserved
• 2026-08-27 (Thu): Vendor notified
• 2026-10-23 (Fri): Transferred CVE to the vendor for record management
• 2026-10-26 (Mon): This public disclosure