Vulnerability in Supermicro A1sa2-2750f
CVE-2019-16650
On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number. In opportunistic circumstances, an attacker can simply connect to the virtual media service, and then connect virtual USB devices to the server managed by the BMC.
EPSS: 0.022 (80.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Supermicro A1sa2-2750f
- Supermicro A1sa2-2750f_firmware — versions 3.83
- Supermicro A1sai-2550f
- Supermicro A1sai-2550f_firmware — versions 3.83
- Supermicro A1sai-2750f
- Supermicro A1sai-2750f_firmware — versions 3.83
- Supermicro A1sam-2550f
- Supermicro A1sam-2550f_firmware — versions 3.83
- Supermicro A1sam-2750f
- Supermicro A1sam-2750f_firmware — versions 3.83
References
- cve@mitre.org (Third Party Advisory, x_refsource_MISC, Mitigation)
- cve@mitre.org (Third Party Advisory, x_refsource_MISC)
- cve@mitre.org (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-16650?
- CVE-2019-16650 is a critical-severity vulnerability in Supermicro A1sa2-2750f. CVSS score: 10.0/10. Published 2019-09-21.
- How severe is CVE-2019-16650?
- Critical severity. CVSS v3 base score is 10.0 out of 10.