Supermicro ATEN Arbitrary File Read

Executive summary #

Supermicro ATEN-based BMCs expose an OEM IPMI command, NetFn 0x30 command 0xae (OEMHW1Command), whose first data byte selects a sub-function. Sub-command 0x2e is a file-transfer helper: an fd_open operation copies a caller-named file into the fixed staging path /tmp/filedump, and an fd_read operation streams that staging file back to the caller at a caller-chosen offset and length. On X13 2401MS 01.07.01 the source path is taken verbatim from the request with only an access(path, R_OK) existence check, so an authenticated IPMI Administrator reads any file the BMC process (root) can read. On H13SSF 01.09.16 the same chain is present with a substring denylist that covers only a set of /nv/bios paths and does not restrict /etc/shadow, the SSH host keys, the U-Boot environment, or the stored configuration. This vulnerability has an estimated CVSSv3.1 score of CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N (4.9, Medium), and is an instance of CWE-73 (External Control of File Name or Path) and CWE-552 (Files or Directories Accessible to External Parties).

Technical details #

The request is NetFn 0x30 command 0xae with the OEMHW1 sub-command byte 0x2e first, then a file-operation selector byte. fd_open (selector 0x00) takes a mode byte and an ASCII path; mode 0x01 copies the named file to /tmp/filedump. fd_read (selector 0x03) takes a 32-bit little-endian offset and a 32-bit little-endian length and returns that slice of /tmp/filedump.

fd_open (copy to /tmp/filedump):  30 ae 2e 00 01 <ascii path...>
fd_read (offset, length):         30 ae 2e 03 <off u32 LE> <len u32 LE>

On X13 2401MS 01.07.01 the fd_open copy path (fd_open in lib/libipmi.so) calls fopen("/tmp/filedump","w"), fopen(<attacker path>,"r") and byte-copies, with only access(<path>, R_OK) in front and no directory or .. filter. fd_read re-opens the fixed /tmp/filedump and freads the requested offset and length straight into the reply. The OEM command table registers OEMHW1Command at NetFn 0x30, command 0xae, minimum privilege Administrator, with no channel restriction, so it is reachable over the LAN/RMCP+ channel.

A completion code of 0x00 returns the requested bytes; 0xce indicates an open, seek, or short-read error; 0xc9 a bad length. Incrementing the offset dword streams the whole file.

Attacker value #

This issue may allow an authenticated IPMI Administrator to escalate privileges to root, allowing read access to the underlying BMC filesystem. This ends up disclosing material well beyond the intended IPMI management role. Reachable content includes /etc/shadow, the dropbear SSH host private keys, the U-Boot environment, the debug CPLD public key, and the stored configuration archive whose PSBlock member holds every account password under a firmware-static AES key (recoverable with no further access). The primitive is an authenticated Administrator RMCP+ session, and can be chained with other issues where Administrator is reachable without a password, such as CVE-2026-18449, or through the reserved role-byte escalation from a low-privilege account as described in CVE-2026-65220. Once root access is secured, the exposed SSH host keys and account hashes support lateral movement and offline credential recovery.

Credit #

This issue was discovered by HD Moore with the help of AI tools. Disclosure was coordinated by Tod Beardsley.

Timeline #

• 2026-08-12 (Wed): Initial findings discovered and documented
• 2026-07-21 (Tue): CVE-2026-65210 reserved
• 2026-08-27 (Thu): Vendor notified
• 2026-10-23 (Fri): Transferred CVE to the vendor for record management
• 2026-10-26 (Mon): This public disclosure