Supermicro BMC SMTP service configuration handler on AS-2115HS-TNR and related boards: Crafted characters injected

Impact

Crafted characters injected into the SMTP configuration are executed by the underlying BMC system when the mail process is invoked. The attacker gets arbitrary code execution or a hard denial of service on the controller, and Supermicro's own wording allows for permanent compromise of the controller - meaning an implant that persists in BMC flash. For an operator this is the same nightmare as any BMC RCE: out-of-band power and console control, virtual-media boot of an attacker image, and a foothold below the reimage boundary. The 2026 recurrence of the same notification-service injection class that produced CVE-2023-35861 three years earlier.

Who can reach it

An attacker who has obtained BMC administrator privileges and can reach the BMC's configuration interface over the network. Shared fleet-wide BMC credentials, leaked provisioning secrets, or a chained lower-privilege bug all put an attacker at this level.

What to do

Firmware flash from Supermicro's June 2026 BMC/IPMI advisory batch, per board SKU. Config-only interim mitigation: disable BMC SMTP alerting and rotate BMC admin credentials to per-node unique values. The fact that this is the second SMTP-handler injection in this codebase in three years is itself operator-relevant - treat the BMC notification subsystem as untrusted attack surface and disable it on nodes that get their alerting from IPMI polling or Redfish instead.

References