Database/Firmware, BMC & network fabric
Supermicro BMC firmware validation (MBD-X13SEM-F): Second-generation RoT bypass
Impact
Second-generation RoT bypass — crafted image passes BMC firmware validation logic (CWE-347, improper signature verification); survives reimaging
Who can reach it
Network, high-privilege
What to do
Per-node out-of-band BMC flash to the fixed Supermicro build; no host-side mitigation exists
Fleet impact
How widespread
very common - affects an additional Supermicro product set beyond CVE-2024-10237
Cost to remediate
firmware-flash - out-of-band per node; once RoT is defeated, prior attestation evidence is untrustworthy and nodes need re-baselining
Why it hits the whole fleet
Bypasses the BMC Root of Trust, so the firmware-signing anchor a neocloud relies on for tenant-isolation claims is defeated below the OS.
References
Related entries
- AMD Pensando ionic driver on ESXi: untrusted pointer dereference lets a guest VM read kernel and co-tenant memoryCVE-2025-62627 · AMD Pensando ionic cloud driver for VMware ESXi (DPU datapath)High
- Supermicro BMC firmware validation (MBD-X12STW): RoT bypass, crafted firmware image acceptedCVE-2025-7937 · Supermicro BMC firmware validation (MBD-X12STW)High
- Supermicro BMC web server request handling on MBD-X13SEDW-F: Any account that can log into the BMC web interface canCVE-2025-8076 · Supermicro BMC web server request handling on MBD-X13SEDW-FHigh
- Supermicro BMC web interface (stack buffer overflow, X13SEDW-F): Second authenticated stack overflow in the BMC webCVE-2025-8727 · Supermicro BMC web interface (stack buffer overflow, X13SEDW-F)High
- Perle IOLAN STS/SCS terminal server (firmware before 6.0): A logged-in user of the restricted admin shell (TelnetCVE-2026-23759 · Perle IOLAN STS/SCS terminal server (firmware before 6.0)High
- Supermicro BMC SMTP service configuration handler on AS-2115HS-TNR and related boards: Crafted characters injectedCVE-2026-3820 · Supermicro BMC SMTP service configuration handler on AS-2115HS-TNR and related boardsHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.