Supermicro BMC: authenticated IPMI Administrator can read and write BMC physical memory and run code on the BMC OS

Impact

An account already holding IPMI Administrator rights can read and write arbitrary physical memory on the baseboard management controller, which the advisory states leads to code execution on the BMC's own operating system. That turns an administrative credential into a foothold on the service processor itself: an attacker-controlled BMC can lie to monitoring, survive host reimaging, and sits on the management network with a view of every other node reachable from it. For a GPU fleet the practical concern is a shared or reused IPMI admin credential, or a management tool whose credentials leak, becoming firmware-level persistence on nodes that are expensive to take out of service.

Who can reach it

Network to the BMC, but authentication is required and at the highest level - an IPMI Administrator account. No tenant or host-OS access is needed; this is an escalation from BMC admin to BMC firmware execution.

What to do

Flash the fixed BMC firmware from Supermicro's October 2026 BMC/IPMI advisory for the affected X12SPI boards; the flash is out of band and resets the BMC, so expect management sessions to drop. Alongside it, rotate IPMI credentials, remove shared Administrator accounts, and drop any node whose BMC you suspect was touched to a full firmware reflash rather than a host reinstall, since the advisory's impact is persistence on the service processor.

References

Related entries

• Dell OMSA: high-privileged remote user escalates beyond their assigned OMSA roleCVE-2026-81445 · Dell OpenManage Server Administrator (privilege management, admin-level)High
• Dell OMSA: remote heap overflow gives code execution to a high-privileged accountCVE-2026-81477 · Dell OpenManage Server Administrator (remote heap-based buffer overflow)High
• Dell OMSA: remote stack overflow gives code execution to a high-privileged accountCVE-2026-81480 · Dell OpenManage Server Administrator (stack-based buffer overflow)High
• Intel CSME / Converged Security and Management Engine (mask ROM): A flaw in the CSME boot ROM window before memoryCVE-2019-0090 · Intel CSME / Converged Security and Management Engine (mask ROM)High
• Dell iDRAC9 (web interface, local file inclusion): A path-traversal / local-file-inclusion flaw lets a low-privilegeCVE-2020-5366 · Dell iDRAC9 (web interface, local file inclusion)High
• Dell iDRAC9: TOCTOU race during simultaneous web-interface access — state corruption on the BMCCVE-2021-21539 · Dell iDRAC9High