Medium severity · published Apr 7, 2023
CVE-2022-43309
Supermicro X11SSL-CF HW Rev 1.01, BMC firmware v1.63 was discovered to contain insecure permissions
5.5
CVSS
0.2%
EPSS
No
On KEV
Description
Supermicro X11SSL-CF HW Rev 1.01, BMC firmware v1.63 was discovered to contain insecure permissions.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XF
X11dac Firmware · Supermicro
All versions, or not specified · source: NVD
XF
X11dai-n Firmware · Supermicro
All versions, or not specified · source: NVD
XF
X11ddw-l Firmware · Supermicro
All versions, or not specified · source: NVD
XF
X11ddw-nt Firmware · Supermicro
All versions, or not specified · source: NVD
XF
X11dgo-t Firmware · Supermicro
All versions, or not specified · source: NVD
XF
X11dgq Firmware · Supermicro
All versions, or not specified · source: NVD
XF
X11dpff-sn Firmware · Supermicro
All versions, or not specified · source: NVD
XF
X11dpfr-s Firmware · Supermicro
All versions, or not specified · source: NVD
XF
X11dpfr-sn Firmware · Supermicro
All versions, or not specified · source: NVD
XF
X11dpg-ot-cpu Firmware · Supermicro
All versions, or not specified · source: NVD
XF
X11dpg-qt Firmware · Supermicro
All versions, or not specified · source: NVD
XF
X11dpg-sn Firmware · Supermicro
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-43309
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-43309
Vendor Advisory
https://www.supermicro.com/en/support/security_VRM_Jan_2023
More from X11dac Firmware
10.0
CVE-2019-16650
On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number
10.0
CVE-2019-16649
On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of BMC credentials and…