Critical severity · published Sep 21, 2019
CVE-2019-16649
On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of BMC credentials and…
10.0
CVSS
0.9%
EPSS
No
On KEV
Description
On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of BMC credentials and data transferred over virtual media devices. Attackers can use captured credentials to connect virtual USB devices to the server managed by the BMC.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XF
X11dac Firmware · Supermicro
1.71.5 · source: NVD
XF
X11dai-n Firmware · Supermicro
1.71.5 · source: NVD
XF
X11ddw-l Firmware · Supermicro
1.71.5 · source: NVD
XF
X11ddw-nt Firmware · Supermicro
1.71.5 · source: NVD
XF
X11dgo-t Firmware · Supermicro
1.71.5 · source: NVD
XF
X11dgq Firmware · Supermicro
1.71.5 · source: NVD
XF
X11dpff-sn Firmware · Supermicro
1.71.5 · source: NVD
XF
X11dpfr-s Firmware · Supermicro
1.71.5 · source: NVD
XF
X11dpfr-sn Firmware · Supermicro
1.71.5 · source: NVD
XF
X11dpg-ot-cpu Firmware · Supermicro
1.71.5 · source: NVD
XF
X11dpg-qt Firmware · Supermicro
1.71.5 · source: NVD
XF
X11dpg-sn Firmware · Supermicro
1.71.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-16649
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-16649
Third Party Advisory
https://eclypsium.com/2019/09/03/usbanywhere-bmc-vulnerability-opens-servers-to-remote-attack/
Third Party Advisory
https://github.com/eclypsium/USBAnywhere
Vendor Advisory
https://www.supermicro.com/support/security_BMC_virtual_media.cfm
More from X11dac Firmware
10.0
CVE-2019-16650
On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number
5.5
CVE-2022-43309
Supermicro X11SSL-CF HW Rev 1.01, BMC firmware v1.63 was discovered to contain insecure permissions