Supermicro BMC configuration functionality on X11 and M11 based boards through firmware 3.17.02: Arbitrary command

Impact

Arbitrary command execution on the BMC from an authenticated session, reached through configuration rather than a web handler. The operational significance of it being a separate path is that disabling or firewalling one interface does not close both - an operator who patched around CVE-2023-33412 without flashing still has this one. Outcome is BMC-level control of the node: power, boot device, console, and persistent firmware residency. A second, distinct command-execution path from the same December 2023 disclosure, this one in the settings surface rather than the CGI endpoints.

Who can reach it

An authenticated remote BMC user reaching the controller's configuration surface over the management network, at ordinary user privilege rather than administrator. Any valid credential on an X11 or M11 BMC below firmware 3.17.02 is enough, which includes the read-only accounts operators hand to monitoring systems and the shared credentials that most whitebox fleets still use across every node.

What to do

Firmware flash to 3.17.02 or later per board SKU from the December 2023 Supermicro BMC advisory - the same image that fixes CVE-2023-33411 and CVE-2023-33412, so treat all three as one flash campaign rather than three. For X11 boards past end of firmware support, network isolation of the management VLAN is the only remaining control, and that should be documented as an accepted permanent risk rather than a temporary workaround.

References