Buffer overflow in Supermicro Intelligent Platform Management Firmware
CVE-2013-3623
Multiple stack-based buffer overflows in cgi/close_window.cgi in the web interface in the Intelligent Platform Management Interface (IPMI) with firmware before 3.15 (SMT_X9_315) on Supermicro X9 generation motherboards allow remote attackers to execute arbitrary code via the (1) sess_sid or (2) ACT parameter.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v2 metric
CVSS v2 base score 10.0 (High). Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.724 (99.4th percentile), scored .
High probability of exploitation in the next 30 days — patch promptly. 99th percentile — 99.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.724 · newest: 0.724 · change: 0.000
Affected products
- Supermicro Intelligent Platform Management Firmware — versions 2.24
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.exploit-db.com/exploits/29666 (Exploit, exploit)
- www.supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf (Vendor Advisory)
- community.rapid7.com/community/metasploit/blog/2013/11/06/supermicro-ipmi-firmw… (Exploit)
- www.thomas-krenn.com/en/wiki/Supermicro_IPMI_Security_Updates_November_2013
- support.citrix.com/article/CTX216642
- www.securityfocus.com/bid/63775 (vdb-entry)
Frequently asked questions
- What is CVE-2013-3623?
- CVE-2013-3623 is a vulnerability in Supermicro Intelligent Platform Management Firmware, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2013-12-10.
- Is CVE-2013-3623 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.