CVE-2019-19642

HIGH

8.8

Description

On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who can send HTTP requests to the IPMI IP address. This requires a POST to /rpc/setvmdrive.asp with shell metacharacters in ShareHost or ShareName. The attacker can achieve a persistent backdoor.

Details CVE

Score CVSS v3.18.8

SeveriteHIGH

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisLOW

Interaction utilisateurNONE

Publie12/8/2019

Derniere modification11/21/2024

Sourcenvd

Observations honeypot0

Produits affectes

supermicro:x8sti-fsupermicro:x8sti-f_biossupermicro:x8sti-f_firmware

Faiblesses (CWE)

CWE-78

References

https://www.dark-sec.net/2019/12/supermicro-ipmi-exploitation.html(cve@mitre.org)

https://www.dark-sec.net/2019/12/supermicro-ipmi-exploitation.html(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.