High severity · published Jan 2, 2020
CVE-2013-3619
Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before SMT_X9_317 and firmware for Supermicro X8 generation motherboards…
8.1
CVSS
9.7%
EPSS
No
On KEV
Description
Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before SMT_X9_317 and firmware for Supermicro X8 generation motherboards before SMT X8 312 contain harcoded private encryption keys for the (1) Lighttpd web server SSL interface and the (2) Dropbear SSH daemon.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)9.7% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NF
Netscaler Firmware · Citrix
All versions, or not specified · source: NVD
NS
Netscaler Sd-wan Firmware · Citrix
All versions, or not specified · source: NVD
NS
Netscaler Sdx Firmware · Citrix
10 · source: NVD
SX
Smt X8 Firmware · Supermicro
before 3.12 · source: NVD
SX
Smt X9 Firmware · Supermicro
before 3.15 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2013-3619
CVE.org
https://www.cve.org/CVERecord?id=CVE-2013-3619
Third Party Advisory
http://support.citrix.com/article/CTX216642
Third Party Advisory
https://community.rapid7.com/community/metasploit/blog/2013/11/05/supermicro-ipmi-firmware-vulnerabilities
Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/89044
Third Party Advisory
https://support.citrix.com/article/CTX216642
Vendor Advisory
https://www.supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf
More from Netscaler Firmware
7.5
CVE-2013-3620
Hardcoded WSMan credentials in Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before 3.15 (SMT_X9_315) and firmware for…