Supermicro BMC: guessable HTML5 KVM console session tokens allow hijacking a remote console

Impact

The HTML5 KVM-over-IP console authorises a session with a token handed out by the BMC web interface, and the token is generated weakly enough that it can be guessed. An unauthenticated attacker who can reach the BMC web service may attach to a KVM session an operator is using, which means seeing the node's console - BIOS setup, bootloader, login prompts, anything typed there. On a GPU node the console is where firmware settings, boot configuration and break-glass credentials get handled, so console visibility during a maintenance window leaks exactly the material an operator does not want seen. Supermicro scores this 3.1: it needs an operator to be using the console at the time and the recorded impact is limited confidentiality, not control of the node.

Who can reach it

Anyone who can reach the BMC web interface on the management network. No authentication required, but it depends on a legitimate console session being open (user interaction).

What to do

Update the BMC firmware per Supermicro's October 2026 BMC/IPMI advisory; the flash is out of band and resets the controller, so avoid doing it while the node is in service via virtual media. Pending the flash, the practical mitigation is network position: keep BMC web and KVM ports reachable only from a dedicated management VLAN or jump host, never from tenant or general networks.

References

Related entries

• AMD IOMMU access control - SEV-SNP RMP check bypass (AMD-SB-3009): An IOMMU access-control flaw lets a privilegedCVE-2023-20581 · AMD IOMMU access control - SEV-SNP RMP check bypass (AMD-SB-3009)Low
• Intel TDX module firmware: Missing check for an exceptional condition in the TDX module allows a privileged userCVE-2024-27457 · Intel TDX module firmwareLow
• AMI MegaRAC SPx (embedded lighttpd web server): Use-after-free in the lighttpd request parser embedded in MegaRAC SPxCVE-2018-25103 · AMI MegaRAC SPx (embedded lighttpd web server)Low
• Intel TDX firmware: Improper synchronisation in TDX firmware, exploitable by a privileged host user to escalateCVE-2025-22853 · Intel TDX firmwareLow
• Arista EOS: SNMPv3 localized key hashes exposed in running and sanitized configurationsCVE-2026-73440 · Arista EOS (SNMPv3 user configuration)Low
• Arista EOS: brief windows where 802.1X supplicant traffic passes without ACL enforcementCVE-2026-75943 · Arista EOS (802.1X dot1x ACL enforcement timing)Low