Back to the CVE list
CVE-2023-33412

Vulnerability in Supermicro M11sdv 4c Ln4f Firmware

CVSS score

8.8

EPSS probability

%1.2

Risk score

0.1

Published

2 y ago

OverviewPublic Exploits (0)NewsroomVulnerability Timeline
Patch status has not yet been verified

Resmî kaynaklarda yeterli kanıt bulunamadı. Bu sonuç “yama yok” anlamına gelmez.

Impact on My Inventory

Only the personal products you have added to your account are assessed; an organisation's inventory does not appear here.

Checking session…

Vulnerability description

DayBreach CVE AI Research

CVE-2023-33412 has vendor, distribution, patch and security-source records on file. We can compare them and prepare an explanation linked to the evidence.

The web interface in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 and M11 based devices, with firmware versions before 3.17.02, allows remote authenticated users to execute arbitrary commands via a crafted request targeting vulnerable cgi endpoints.

IMPACT: Affected Products and Software

Affected Products

The following products are affected by CVE-2023-33412 vulnerability. Where our threat engine knows the exact affected versions, they are listed below.

IDVENDORPRODUCTACTION
1supermicrom11sdv-4c-ln4f firmware View
2supermicrom11sdv-4c-ln4f View
3supermicrom11sdv-4ct-ln4f firmware View
4supermicrom11sdv-4ct-ln4f View
5supermicrom11sdv-8c-ln4f firmware View
6supermicrom11sdv-8c-ln4f View
7supermicrom11sdv-8ct-ln4f firmware View
8supermicrom11sdv-8ct-ln4f View
9supermicroc9x299-pg firmware View
10supermicroc9x299-pg View
11supermicroc9x299-pg300 firmware View
12supermicroc9x299-pg300 View
13supermicroc9x299-pg300f firmware View
14supermicroc9x299-pg300f View
15supermicroc9x299-pgf firmware View
16supermicroc9x299-pgf View
17supermicroc9x299-pgf-l firmware View
18supermicroc9x299-pgf-l View
19supermicroc9x299-rpgf firmware View
20supermicroc9x299-rpgf View
21supermicroc9x299-rpgf-l firmware View
22supermicroc9x299-rpgf-l View
23supermicrob13dee firmware View
24supermicrob13dee View
25supermicrob13det firmware View
26supermicrob13det View
27supermicrob13see-cpu-25g firmware View
28supermicrob13see-cpu-25g View
29supermicrob13seg firmware View
30supermicrob13seg View
31supermicroh13dsg-o-cpu firmware View
32supermicroh13dsg-o-cpu View
33supermicroh13dsg-o-cpu-d firmware View
34supermicroh13dsg-o-cpu-d View
35supermicroh13dsg-om firmware View
36supermicroh13dsg-om View
37supermicroh13dsh firmware View
38supermicroh13dsh View
39supermicroh13sae-mf firmware View
40supermicroh13sae-mf View
41supermicroh13sra-f firmware View
42supermicroh13sra-f View
43supermicroh13sra-tf firmware View
44supermicroh13sra-tf View
45supermicroh13srd-f firmware View
46supermicroh13srd-f View
47supermicroh13ssf firmware View
48supermicroh13ssf View
49supermicroh13ssh firmware View
50supermicroh13ssh View
51supermicroh13ssl-n firmware View
52supermicroh13ssl-n View
53supermicroh13ssl-nt firmware View
54supermicroh13ssl-nt View
55supermicroh13sst-g firmware View
56supermicroh13sst-g View
57supermicroh13sst-gc firmware View
58supermicroh13sst-gc View
59supermicroh13ssw firmware View
60supermicroh13ssw View
61supermicroh13svw-n firmware View
62supermicroh13svw-n View
63supermicroh13svw-nt firmware View
64supermicroh13svw-nt View
65supermicrox13dai-t firmware View
66supermicrox13dai-t View
67supermicrox13ddw-a firmware View
68supermicrox13ddw-a View
69supermicrox13deg-oa firmware View
70supermicrox13deg-oa View
71supermicrox13deg-oad firmware View
72supermicrox13deg-oad View
73supermicrox13deg-pvc firmware View
74supermicrox13deg-pvc View
75supermicrox13deg-qt firmware View
76supermicrox13deg-qt View
77supermicrox13deh firmware View
78supermicrox13deh View
79supermicrox13dei firmware View
80supermicrox13dei View
81supermicrox13dei-t firmware View
82supermicrox13dei-t View
83supermicrox13dem firmware View
84supermicrox13dem View
85supermicrox13det-b firmware View
86supermicrox13det-b View
87supermicrox13dgu firmware View
88supermicrox13dgu View
89supermicrox13dsf-a firmware View
90supermicrox13dsf-a View
91supermicrox13qeh+ firmware View
92supermicrox13qeh+ View
93supermicrox13sae firmware View
94supermicrox13sae View
95supermicrox13sae-f firmware View
96supermicrox13sae-f View
97supermicrox13san-c firmware View
98supermicrox13san-c View
99supermicrox13san-c-wohs firmware View
100supermicrox13san-c-wohs View
101supermicrox13san-e firmware View
102supermicrox13san-e View
103supermicrox13san-e-wohs firmware View
104supermicrox13san-e-wohs View
105supermicrox13san-h firmware View
106supermicrox13san-h View
107supermicrox13san-h-wohs firmware View
108supermicrox13san-h-wohs View
109supermicrox13san-l firmware View
110supermicrox13san-l View
111supermicrox13san-l-wohs firmware View
112supermicrox13san-l-wohs View
113supermicrox13saq firmware View
114supermicrox13saq View
115supermicrox13sav-lvds firmware View
116supermicrox13sav-lvds View
117supermicrox13sav-ps firmware View
118supermicrox13sav-ps View
119supermicrox13saz-f firmware View
120supermicrox13saz-f View
121supermicrox13saz-q firmware View
122supermicrox13saz-q View
123supermicrox13sedw-f firmware View
124supermicrox13sedw-f View
125supermicrox13seed-f firmware View
126supermicrox13seed-f View
127supermicrox13seed-sf firmware View
128supermicrox13seed-sf View
129supermicrox13sefr-a firmware View
130supermicrox13sefr-a View
131supermicrox13sei-f firmware View
132supermicrox13sei-f View
133supermicrox13sei-tf firmware View
134supermicrox13sei-tf View
135supermicrox13sem-f firmware View
136supermicrox13sem-f View
137supermicrox13sem-tf firmware View
138supermicrox13sem-tf View
139supermicrox13set-g firmware View
140supermicrox13set-g View
141supermicrox13set-gc firmware View
142supermicrox13set-gc View
143supermicrox13sew-f firmware View
144supermicrox13sew-f View
145supermicrox13sew-tf firmware View
146supermicrox13sew-tf View
147supermicrox13sra-tf firmware View
148supermicrox13sra-tf View
149supermicrox13srn-e firmware View
150supermicrox13srn-e View
151supermicrox13srn-e-wohs firmware View
152supermicrox13srn-e-wohs View
153supermicrox13srn-h firmware View
154supermicrox13srn-h View
155supermicrox13srn-h-wohs firmware View
156supermicrox13srn-h-wohs View
157supermicrox13swa-tf firmware View
158supermicrox13swa-tf View
159supermicrob12dpe-6 firmware View
160supermicrob12dpe-6 View
161supermicrob12dpt-6 firmware View
162supermicrob12dpt-6 View
163supermicrob12spe-cpu-25g firmware View
164supermicrob12spe-cpu-25g View
165supermicroh12dgo-6 firmware View
166supermicroh12dgo-6 View
167supermicroh12dgq-nt6 firmware View
168supermicroh12dgq-nt6 View
169supermicroh12dsg-o-cpu firmware View
170supermicroh12dsg-o-cpu View
171supermicroh12dsg-q-cpu6 firmware View
172supermicroh12dsg-q-cpu6 View
173supermicroh12dsi-n6 firmware View
174supermicroh12dsi-n6 View
175supermicroh12dsi-nt6 firmware View
176supermicroh12dsi-nt6 View
177supermicroh12dst-b firmware View
178supermicroh12dst-b View
179supermicroh12dsu-in firmware View
180supermicroh12dsu-in View
181supermicroh12dsu-inr firmware View
182supermicroh12dsu-inr View
183supermicroh12ssff-an6 firmware View
184supermicroh12ssff-an6 View
185supermicroh12ssfr-an6 firmware View
186supermicroh12ssfr-an6 View
187supermicroh12ssg-an6 firmware View
188supermicroh12ssg-an6 View
189supermicroh12ssg-anp6 firmware View
190supermicroh12ssg-anp6 View
191supermicroh12ssl-c firmware View
192supermicroh12ssl-c View
193supermicroh12ssl-ct firmware View
194supermicroh12ssl-ct View
195supermicroh12ssl-i firmware View
196supermicroh12ssl-i View
197supermicroh12ssl-nt firmware View
198supermicroh12ssl-nt View
199supermicroh12sst-ps firmware View
200supermicroh12sst-ps View
Total affected vendors: 1|Products: 200

RED HAT CSAF/VEX: Product Impact Check

Red Hat has not yet published a CSAF/VEX impact record for this CVE. This does not mean “not affected”.

SCORING: CVSS from Multiple Sources

CVSS Scores

The Common Vulnerability Scoring System is a standardised framework for assessing the severity of vulnerabilities in software and systems. We collect and display CVSS scores from several sources for each CVE.

SCOREVERSIONSEVERITYVECTORSOURCE
8.8CVSS V31HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD

Patch and Remediation Guide

Solution & Remediation Advisory

Patch status unknown

İncelenen resmî kaynaklarda yama durumu doğrulanamadı. Bu sonuç “yama yok” anlamına gelmez.

Confirm the affected product and version against the source evidence above.
Restrict access to internet-facing services and apply network segmentation.
Until a patch is confirmed, follow the vendor advisory; do not read an unknown status as “no patch”.
Monitor server logs and network endpoints for signs of anomalous execution.

Public exploit and active exploitation status

Verified exploit intelligence

No verified public PoC, exploit repository or Metasploit module has been found for this CVE yet.

Weakness Classification and Attack Patterns (CWE & CAPEC)

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorises the common flaws or weaknesses that can lead to vulnerabilities. CVE-2023-33412 is associated with the following CWEs:

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CWE-20: Improper Input Validation

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2023-33412 weaknesses.

CAPEC-66: SQL InjectionCAPEC-126: Path TraversalCAPEC-28: OS Command Injection

Attack Vector and Accessibility

ExposureAğ üzerinden
PermissionsLow
UserGerekmiyor

Official Sources and Advisories

https://www.supermicro.com/en/support/security_BMC_Dec_2023vendor-advisory

CVSS Vector Radar Chart

8.8 / 10
Attack VectorNetworkComplexityLowPrivilegesLowUser Interact.NoneConfidentialityLowIntegrityNoneAvailabilityHigh

Vulnerability Scoring Details

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredLow privileges
User InteractionNone required
Confidentiality (Gizlilik)Low
Integrity (Bütünlük)None
Availability (Erişilebilirlik)High

Yama durumu bilinmiyor

İncelenen resmî kaynaklarda yama durumu doğrulanamadı. Bu sonuç “yama yok” anlamına gelmez.

Follow the vendor

S
supermicro logo
supermicro

Similar Vulnerabilities

Get this vulnerability through the API

Affected products, version ranges, exploitation status and patch information in a single request, with a free key.

Get a free keyDocumentation
curl -H "x-api-key: $DAYBREACH_API_KEY" \
  "https://api.daybreach.dev/api/v1/intel/cves/CVE-2023-33412"