Supermicro BMC web server request handling on MBD-X13SEDW-F: Any account that can log into the BMC web interface can

Impact

Any account that can log into the BMC web interface can turn that login into code execution on the controller. For an operator this collapses the distinction between 'someone has a BMC password' and 'someone owns the node out of band' - they get power control, console, virtual-media boot of an attacker image, and a persistence point below the hypervisor that reimaging will not clear. A post-authentication stack buffer overflow triggered by a crafted payload to the management web UI.

Who can reach it

An authenticated high-privilege session against the BMC's HTTP interface, reachable from anywhere routable to the out-of-band management network. In fleets that share one BMC password across every node - still the norm - a single credential leak makes this exploitable everywhere at once.

What to do

Firmware flash from Supermicro's November 2025 BMC/IPMI advisory. Config-only measures that reduce exposure now: put BMC web access behind a bastion so it is not reachable from the general management subnet, rotate to per-node BMC credentials, and disable the BMC web UI on nodes managed purely via Redfish or IPMI. Flashing is per node and out of band; plan it alongside the other X13 BMC fixes in the same advisory so you only take one flash window.

References