Supermicro IPMI BMC web interface (login.cgi) - H8/X7/X8/X9 generation boards, firmware before SMT_X9_315

Impact

Unauthenticated root on the baseboard management controller, delivered through the login form. The BMC web server strcpy()s the submitted username and password into fixed 128-byte and 24-byte stack buffers, so an over-long login field executes code on the service processor before any credential is checked. Owning the BMC is strictly better than owning the host: it survives OS reinstall, it can reflash the BIOS, it can mount virtual media to boot arbitrary code, it can power-cycle the node, and it can read the host's console. In a GPU rental fleet, one compromised BMC is a persistent implant under every tenant that ever lands on that node. CERT counted roughly 135 affected board models across 30 firmware versions - this is not a niche SKU.

Who can reach it

Network, pre-auth. Anything that can reach the BMC's HTTP(S) port. Fatal when the management network is flat, reachable from tenant VLANs, or - as internet scans repeatedly found - exposed directly to the internet.

What to do

Flash BMC firmware to SMT_X9_315 or later. Roughly 10-20 minutes per node including the BMC reset, and the node should be drained first because a BMC reset during a job risks losing console and out-of-band control mid-flight - and on some boards a failed flash bricks the management controller entirely, so this is a change window, not a rolling background task. The compensating control to apply immediately regardless of firmware state is network: BMCs belong on an isolated management VLAN reachable only from a bastion, never routable from tenant networks. Most operators with this exposure have a topology problem, not just a firmware problem.

References

Related entries

• Supermicro BMC (IPMI cipher suite 0): Authentication bypassCVE-2013-4782 · Supermicro BMC (IPMI cipher suite 0)Critical
• Dell iDRAC (IPMI 1.5 cipher 0): Remote authentication bypass via cipher suite 0CVE-2013-4783 · Dell iDRAC (IPMI 1.5 cipher 0)Critical
• HPE iLO (IPMI cipher 0): IPMI authentication bypass via cipher suite 0 on the iLO BMCCVE-2013-4784 · HPE iLO (IPMI cipher 0)Critical
• Raritan PX rack PDU (before firmware 1.5.11, DPXR20A-16 and related PX models): The PDU's IPMI interface acceptsCVE-2014-2955 · Raritan PX rack PDU (before firmware 1.5.11, DPXR20A-16 and related PX models)Critical
• Supermicro BMC virtual media (H11/H12/M11/X9/X10/X11): Virtual media service uses weak/absent encryptionCVE-2019-16649 · Supermicro BMC virtual media (H11/H12/M11/X9/X10/X11)Critical
• Supermicro X10/X11 BMC (virtual media service): The BMC's virtual media service reuses socket file descriptors, soCVE-2019-16650 · Supermicro X10/X11 BMC (virtual media service)Critical