Supermicro BMC email/SMTP alert notification handler (H12DST-B): Command execution as root on the BMC, reached through

Impact

Command execution as root on the BMC, reached through a feature nearly every operator turns on because they want temperature and PSU alerts. Root on the BMC is total control of the node's out-of-band plane: power, boot device, serial and graphical console, and the ability to write persistent code that outlives any host reinstall. On a rented bare-metal GPU node it also means the previous tenant's implant can be watching the next tenant's console. Firmware 03.10.35 and present across the same BMC codebase on other Supermicro boards. User-controlled notification fields reach a shell without sanitisation.

Who can reach it

Reachable over the network to the BMC. The alerting configuration surface is exactly the kind of thing left enabled and reachable from the monitoring VLAN, so an attacker who compromises a monitoring or DCIM host is already in position.

What to do

Firmware flash to 03.10.35 or later per board SKU, from Supermicro's June 2023 SMTP advisory. As an immediate config-only stopgap you can disable BMC email alerting entirely, which removes the vulnerable path at the cost of losing hardware alerts - acceptable for a few days, not as a permanent posture. Because this bug is in shared Supermicro BMC code rather than one board's, audit the whole fleet rather than only H12DST-B.

References