Supermicro BMC web interface CGI endpoints on X11 and M11 based boards with BMC firmware before 3.17.02

Impact

An authenticated BMC user runs arbitrary commands on the controller. Because X11 boards are the ones most likely to be running years-behind firmware in a rented or secondhand fleet, this is a realistic path from 'we gave the customer an IPMI login' to full out-of-band ownership of the node: power, console, virtual media, and firmware persistence. Any operator who has ever handed a tenant a BMC account on X11 hardware should assume this is exploitable. The X11 generation is the bulk of the older Supermicro GPU and storage fleet still in production at neoclouds.

Who can reach it

An authenticated BMC session over the network, at ordinary user privilege rather than administrator. Reachable by anything routable to the OOB management VLAN that holds any valid credential.

What to do

Firmware flash to BMC 3.17.02 or later, per board, from Supermicro's December 2023 BMC advisory. On X11 boards this is often a multi-hop upgrade because the fleet is far behind, and some very old X11 SKUs stopped receiving images - for those the honest answer is that there is no fix and the only control is network isolation plus never issuing tenant-facing BMC accounts. Revoke any BMC credentials previously issued to tenants or contractors as part of the same change.

References