Unscored severity · published Sep 8, 2013
CVE-2013-3607
Multiple stack-based buffer overflows in the web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F,…
–
CVSS
9.7%
EPSS
No
On KEV
Description
Multiple stack-based buffer overflows in the web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-*, X9DB*, X9DR*, X9QR*, X9SBAA-F, X9SC*, X9SPU-F, and X9SR* devices allow remote attackers to execute arbitrary code on the Baseboard Management Controller (BMC), as demonstrated by the (1) username or (2) password field in login.cgi.
Exploitation
Is it being used?
Exploit prediction (EPSS)9.7% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
H8
H8dcl-6f · Supermicro
All versions, or not specified · source: NVD
H8
H8dcl-if · Supermicro
All versions, or not specified · source: NVD
H8
H8dct-hibqf · Supermicro
All versions, or not specified · source: NVD
H8
H8dct-hln4f · Supermicro
All versions, or not specified · source: NVD
H8
H8dct-ibqf · Supermicro
All versions, or not specified · source: NVD
H8
H8dg6-f · Supermicro
All versions, or not specified · source: NVD
H8
H8dgg-qf · Supermicro
All versions, or not specified · source: NVD
H8
H8dgi-f · Supermicro
All versions, or not specified · source: NVD
H8
H8dgt-hf · Supermicro
All versions, or not specified · source: NVD
H8
H8dgt-hibqf · Supermicro
All versions, or not specified · source: NVD
H8
H8dgt-hlf · Supermicro
All versions, or not specified · source: NVD
H8
H8dgt-hlibqf · Supermicro
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-3607
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-3607
US Government Resource
http://www.kb.cert.org/vuls/id/648646
www.securityfocus.com
http://www.securityfocus.com/bid/62094
www.supermicro.com
http://www.supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf
www.thomas-krenn.com
http://www.thomas-krenn.com/en/wiki/Supermicro_IPMI_Security_Updates_November_2013
support.citrix.com
https://support.citrix.com/article/CTX216642
Exploit
https://www.usenix.org/system/files/conference/woot13/woot13-bonkoski_0.pdf
More from H8dcl-6f
–
CVE-2013-3609
The web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-*, X9DB*,…
–
CVE-2013-3608
The web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-*, X9DB*,…