Supermicro BMC: stack-based buffer overflow in the Insyde SMASH shell

CVSS 5.4CVE-2025-7704Firmware, BMC & network fabriccurated

Impact

The SMASH CLP shell reachable on the Supermicro BMC has a stack-based overflow. A BMC is the out-of-band root of a server: whoever controls it controls power, boot media, console and firmware for the node, so memory corruption in a shell that BMC users can reach is worth treating seriously on a GPU node that hosts other tenants' workloads. The NVD record is one sentence and does not state whether the overflow is exploitable for code execution or only crashes the service - the vendor's score reflects a limited integrity and availability impact, not full BMC takeover, and the entry stays at that. Confirmed on SYS-111C-NR in the Supermicro October 2025 BMC/IPMI advisory.

Who can reach it

A network-reachable, authenticated BMC user - in practice anyone on the management VLAN who holds BMC credentials. Authentication is required (vendor vector PR:L).

What to do

Apply the BMC firmware update from the Supermicro October 2025 BMC/IPMI security page for the affected platform. BMC firmware can usually be flashed without halting the host OS, but plan for the BMC itself to go away during the update - no out-of-band console or power control while it reboots - and verify afterwards. Independently, the management network should not be reachable from tenant or general corporate networks; that containment is what limits this class of bug. The record does not name a fixed firmware version.

References

https://nvd.nist.gov/vuln/detail/CVE-2025-7704 https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2025

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.