CVEvulnerability

CVE-2019-16649

10.0 CRITICAL Published 2019-09-21 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-09-21
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
10.0 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-287, CWE-326, CWE-522

Description

On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of BMC credentials and data transferred over virtual media devices. Attackers can use captured credentials to connect virtual USB devices to the server managed by the BMC.

Affected configurations

• supermicro x11dai-n firmware 1.71.5 • supermicro x11dac firmware 1.71.5 • supermicro x11dph-tq firmware 1.71.5 • supermicro x11dph-i firmware 1.71.5 • supermicro x11dph-t firmware 1.71.5 • supermicro x11dps-re firmware 1.71.5 • supermicro x11dsf-e firmware 1.71.5 • supermicro x11dsn-ts firmware 1.71.5 • supermicro x11dsn-tsq firmware 1.71.5 • supermicro x11dsc\+ firmware 1.74 • supermicro x11ddw-nt firmware 1.71.5 • supermicro x11ddw-l firmware 1.71.5 • supermicro x11dgq firmware 1.71.5 • supermicro x11dpff-sn firmware 1.71.5 • supermicro x11dpfr-sn firmware 1.71.5 • supermicro x11dpfr-s firmware 1.71.5 • supermicro x11dpt-ps firmware 1.71.5 • supermicro x11dpt-b firmware 1.71.5 • supermicro x11dpt-bh firmware 1.71.5 • supermicro x11dpt-l firmware 3.74 • supermicro x11dpu firmware 1.71.5 • supermicro x11dpu-v firmware 1.71.5 • supermicro x11dpu-x firmware 1.71.5 • supermicro x11dpu-xll firmware 1.71.5 • supermicro x11dpu-z\+ firmware 1.71.5 • supermicro x11dpu-ze\+ firmware 1.71.5 • supermicro x11dpg-sn firmware 1.71.5 • supermicro x11dpg-qt firmware 1.71.5 • supermicro x11dpg-ot-cpu firmware 1.71.5 • supermicro x11dpi-nt firmware 1.71.5 • supermicro x11dpi-n firmware 1.71.5 • supermicro x11dpl-i firmware 1.71.5 • supermicro x11dpx-t firmware 1.71.5 • supermicro x11dgo-t firmware 1.71.5 • supermicro x11sca firmware 1.71.5 • supermicro x11sca-f firmware 1.71.5 • supermicro x11sch-f firmware 1.23.2 • supermicro x11sch-ln4f firmware 1.23.2 • supermicro x11sca-w firmware 1.71.5 • supermicro x11scl-f firmware 1.23.2 • supermicro x11scl-ln4f firmware 1.23.2 • supermicro x11scl-if firmware 1.23.2 • supermicro x11scm-f firmware 1.23.2 • supermicro x11scm-ln8f firmware 1.23.2 • supermicro x11scw-f firmware 3.75.00 • supermicro x11spa-t firmware 1.71.5 • supermicro x11spa-tf firmware 1.71.5 • supermicro x11spi-tf firmware 1.71.6 • supermicro x11spl-f firmware 1.71.6 • supermicro x11spm-f firmware 1.71.6 • supermicro x11spm-tf firmware 1.71.6 • supermicro x11spm-tpf firmware 1.71.6 • supermicro x11sph-nctf firmware 1.71.6 • supermicro x11sph-nctpf firmware 1.71.6 • supermicro x11spw-tf firmware 1.71.6 • supermicro x11spw-ctf firmware 1.71.6 • supermicro x11spg-tf firmware 1.71.6 • supermicro x11sri-if firmware 3.75.00 • supermicro x11srl-f firmware 3.74.2 • supermicro x11srm-f firmware 1.31.1 … and 277 more

Related

Weakness · CWE (3)

  • CWE-287 Improper Authentication weakness
  • CWE-326 Inadequate Encryption Strength weakness
  • CWE-522 Insufficiently Protected Credentials weakness

References