Supermicro BMC SMASH-CLP shell on MBD-X13SEDW-F: Full control of the instruction pointer inside the BMC's firmware OS

Impact

Full control of the instruction pointer inside the BMC's firmware OS from a shell that operators routinely hand to junior staff and monitoring tooling. The attacker converts a limited management login into arbitrary code on the controller, and from there into the standard BMC prize set: power control, console capture, virtual media, and firmware-level persistence. The published CVSS understates this - the vector was scored conservatively, but the described primitive is return-address control. A stack buffer overflow reached by a crafted SMASH command, with control of the saved return address and registers.

Who can reach it

An authenticated low-privilege BMC account with SSH access to the controller. Any operator-tier credential works; no administrator role is needed.

What to do

Firmware flash from Supermicro's November 2025 BMC/IPMI advisory batch, matched to the board SKU. The cheap and immediate mitigation is config-only: turn off SSH/SMASH on the BMC if your management path is Redfish or IPMI-over-LAN. That single change also covers CVE-2026-3821 and the rest of the SMASH overflow cluster, so it is the highest-leverage action available before a flash window opens.

References