Latest Supermicro BMC vulnerabilities #
Supermicro has issued a vulnerability disclosure for a critical vulnerability in "select X11, X12, H12, B12, X13, H13, and B13 motherboards (and CMM6 modules)". CVE-2024-36435 is rated critical with CVSS score of 9.8, and potentially allows for remote code execution by an unauthenticated user.
What is the impact? #
An attacker with remote access to a vulnerable system could send specially crafted requests that could trigger a stack buffer overflow and result in arbitrary remote code execution.
Are updates or workarounds available? #
Supermicro is currently testing and validating BMC firmware updates. According to the disclosure, "As an immediate workaround to reduce the attack surface, it is advised to follow the BMC Configuration Best Practices Guide". They also recommend configuring a session timeout.
How to find potentially vulnerable systems with runZero # #
From the Asset Inventory, use the following query to locate systems running potentially vulnerable software:
(hw:"Super%micro" or os:"Super%micro)
