Supermicro BMC Predictable KVM Tokens

Executive summary #

Supermicro BMCs prior to X14 offer an HTML5 KVM-over-IP console that authenticates through a separate token returned by the web interface. This token is generated by the standard glibc rand() function after being seeded by the current time in seconds. An attacker who can estimate when an administrator opened a KVM session can reconstruct that session's token and take it over. This vulnerability has an estimated CVSSv3.1 score of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N (3.1, Low), and is an instance of CWE-330 (Use of Insufficiently Random Values).

Technical details #

The KVM launch is initiated through the authenticated web interface; the launch then mints a sessionless capability token so the HTML5 client, which does not carry the operator's web session, can connect. That sessionless design is intended and is not the defect; the defect is that the token is drawn from a low-entropy time seed. In libredfish.so, the launch handler seeds the C library PRNG with the current time and draws fifteen characters:

iVar14 = 0xf;                    <i>// 15 characters</i>
uVar21 = time((time_t *)0x0);    <i>// seed = current UNIX time, 1-second granularity</i>
srand(uVar21);
do { local_580[0] = gen_random(); <i>/* append char */</i> } while (--iVar14 != 0);

The fifteen-character token is delivered to the client in the console URL itself. The authenticated launch action returns a console URL of the form /redfish/<token>.IKVM, and fetching that URL is what connects the HTML5 client; the request carries no cookie, session, or credential, so the token embedded in the path is the sole authenticator. On the BMC the token is recorded as /tmp/rf_launch_ikvm_uid_<token> and validated by odata::redfish::token_auth::session_check, so a request for /redfish/<token>.IKVM returns the console only while a matching token is live.

The following result was observed against an X13 unit (firmware 01.07.01). The authenticated launch action reports the current console URL, and that URL is then retrieved with no cookie or credential:

# authenticated launch action reports the console URL carrying the token
GET /redfish/v1/Managers/1/Oem/Supermicro/IKVM
  "URI": "/redfish/TFqgekVS3CZJt7W.IKVM"

# fetching that URL needs no cookie or credential; the path token alone authenticates
GET /redfish/TFqgekVS3CZJt7W.IKVM   -> 200 OK, text/html  (HTML5 console bootstrap, ~59 KB)

# a wrong token is simply not found, with no lockout
GET /redfish/TFqgekVS3CZJt00.IKVM   -> 404 Not Found

Because the only entropy source is time(NULL) at one-second resolution, that path token is reproducible: an attacker who knows the launch time to within a small window enumerates the corresponding seed values, replays srand(seed) followed by fifteen gen_random() calls, and reconstructs the exact token in the URL that authenticates to the administrator's live session. The token space is therefore bounded by the attacker's uncertainty about the launch time in seconds, not by the nominal fifteen-character length.

To reproduce, estimate the launch time of an active KVM session and reconstruct the token for each candidate second, then request /redfish/<token>.IKVM for each until one returns the console:

import ctypes
libc = ctypes.CDLL("libc.so.6")
for seed in range(est_launch_time - window, est_launch_time + window + 1):
    libc.srand(seed)
    token = "".join(gen_random() for _ in range(15))   <i># same draw the firmware uses</i>
    <i># GET https://<bmc>/redfish/<token>.IKVM ; HTTP 200 = valid session, 404 = wrong token</i>

Attacker value #

This issue may allow an unauthenticated attacker to hijack a KVM console session that an administrator has already opened. Two conditions must both hold: an administrator has a live iKVM session (the launch token exists only while a session is active), and the attacker can estimate that session's launch time closely enough to enumerate the small set of one-second seed values within the token's validity window. When they do, the attacker replays the token generator for each candidate seed, recovers the token, and gains the same keyboard, video, and mouse control and BMC-side media redirection as the legitimate session, which is administrator-equivalent over the managed host. With no concurrently active KVM session there is no token to predict.

Credit #

This issue was discovered by HD Moore with the help of AI tools. Disclosure was coordinated by Tod Beardsley.

Timeline #

• 2026-07-18 (Sat): Initial findings discovered and documented
• 2026-07-21 (Tue): CVE-2026-65218 reserved
• 2026-07-24 (Fri): Vendor notified
• 2026-08-06 (Thu): CVE-2026-18451 reserved by SuperMicro, replacing CVE-2026-65218
• 2026-10-26 (Mon): This public disclosure