Supermicro BMC web server on X11 and M11 based boards with firmware up to 3.17.02: An unauthenticated attacker reads

Impact

An unauthenticated attacker reads files out of the BMC's filesystem. In practice that is the credential store, configuration, and keys - which is how this becomes the first link in a chain rather than an information-disclosure footnote: the traversal hands over the credentials needed to exploit CVE-2023-33412 and CVE-2023-33413 on the same box, and because BMC credentials are typically identical across a fleet, one node's disclosure unlocks all of them. Directory traversal in the HTTP server, reachable with no authentication whatsoever.

Who can reach it

Anything routable to the BMC's HTTP interface, unauthenticated. No credential, no host foothold, no tenant access needed - only a network path to the out-of-band management VLAN.

What to do

Firmware flash to BMC 3.17.02 or later per board, from Supermicro's December 2023 advisory. Because this one needs no credentials, it should be at the front of the queue for any X11 fleet, and any node that was ever exposed to an untrusted network should have its BMC credentials treated as compromised and rotated - to unique per-node values, not another shared password. Network isolation buys time but does not help if your management VLAN is flat and reachable from tenant hosts.

References