Supermicro BMC Unauthenticated IPMI Commands

Executive summary #

Supermicro BMCs prior to X14 do not enforce integrity and encryption for IPMI commands. The daemon decides whether to integrity-check and decrypt an inbound packet solely from that packet's own header bits, never comparing them against the cipher suite the session actually negotiated. A packet with both the authenticated and encrypted bits clear is dispatched to the command handler with no HMAC verification and no decryption, regardless of the session's configured cipher suite. This vulnerability has an estimated CVSSv3.1 score of CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (8.1, High), and is an instance of CWE-306 (Missing Authentication for Critical Function).

Technical details #

Supermicro's ipmi_lan packet dispatcher looks up the session by session ID, checks the sequence number, then verifies the HMAC only when the packet's authenticated header bit (0x40) is set and decrypts only when its encrypted header bit (0x80) is set, and dispatches the command either way. Neither check is compared against the cipher suite negotiated for that session at Open Session; a client that simply clears both header bits skips both the HMAC verification and the decryption step entirely, and the command still reaches the dispatcher. This means the mandatory integrity and confidentiality nominally guaranteed by cipher suites 3 and 17 are not actually enforced for inbound commands: any holder of a live session, including one hijacked by a third party, can send cleartext, unsigned, unencrypted commands and have them executed.

The following result was observed against an X13 unit (firmware 1.07): a session is negotiated under cipher suite 3 (mandatory HMAC-SHA1 integrity and AES-CBC-128 confidentiality), then a Get Device ID is sent as payload type 0x00 with both the authenticated and encrypted header bits clear.

open_session cipher-suite=3 sidm=0x12
rakp1 -> rakp2 ok ; rakp3 -> rakp4 status=0x00 (session active)
cleartext Get Device ID (auth bit=0, encrypt bit=0):
  completion_code = 0x00
  data            = 2001010702bf7c2a00000001020000

The cleartext, unsigned, unencrypted request returns a valid Get Device ID completion (cc=0x00) with the device data, against a session that negotiated cipher suite 3, confirming that the negotiated integrity and confidentiality requirement is not enforced on the inbound path. The same holds for cipher suite 17.

Attacker value #

This issue may allow an unauthenticated attacker who can identify an existing RMCP+ session ID to inject unsigned, unencrypted IPMI commands that the BMC executes at that session's privilege. A live activated session must already exist on the target, but this requirement is often met when IPMI-based monitoring tools are in place. Session IDs can be obtained in cleartext from the wire by an on-path attacker or guessed from predictable ID sequences.

Credit #

This issue was discovered by HD Moore with the help of AI tools. Disclosure was coordinated by Tod Beardsley.

Timeline #

• 2026-07-18 (Sat): Initial findings discovered and documented
• 2026-07-21 (Tue): CVE-2026-65216 reserved
• 2026-08-06 (Thu): CVE-2026-18450 reserved by Supermicro, replacing CVE-2026-65216
• 2026-07-24 (Fri): Vendor notified
• 2026-10-26 (Mon): This public disclosure