Supermicro IPMI BMC web interface (login.cgi) - H8/X7/X8/X9 generation boards, firmware before SMT_X9_315

Impact

Unauthenticated root on the baseboard management controller, delivered through the login form. The BMC web server strcpy()s the submitted username and password into fixed 128-byte and 24-byte stack buffers, so an over-long login field executes code on the service processor before any credential is checked. Owning the BMC is strictly better than owning the host: it survives OS reinstall, it can reflash the BIOS, it can mount virtual media to boot arbitrary code, it can power-cycle the node, and it can read the host's console. In a GPU rental fleet, one compromised BMC is a persistent implant under every tenant that ever lands on that node. CERT counted roughly 135 affected board models across 30 firmware versions - this is not a niche SKU.

Who can reach it

Network, pre-auth. Anything that can reach the BMC's HTTP(S) port. Fatal when the management network is flat, reachable from tenant VLANs, or - as internet scans repeatedly found - exposed directly to the internet.

What to do

Flash BMC firmware to SMT_X9_315 or later. Roughly 10-20 minutes per node including the BMC reset, and the node should be drained first because a BMC reset during a job risks losing console and out-of-band control mid-flight - and on some boards a failed flash bricks the management controller entirely, so this is a change window, not a rolling background task. The compensating control to apply immediately regardless of firmware state is network: BMCs belong on an isolated management VLAN reachable only from a bastion, never routable from tenant networks. Most operators with this exposure have a topology problem, not just a firmware problem.

References