CVE-2024-10237

Published: Feb 4, 2025Modified: Feb 4, 2025

7.2

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.2 / Impact: 5.9

Source: def9a96e-e099-41a9-bfac-30fd4f82c411 (Secondary)

Description

There is a vulnerability in the BMC firmware image authentication design at Supermicro MBD-X12DPG-OA6 . An attacker can modify the firmware to bypass BMC inspection and bypass the signature verification process

Related CWEs

CWE-345

Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

CWE-347

Improper Verification of Cryptographic Signature

The product does not verify, or incorrectly verifies, the cryptographic signature for data.

References (1)

https://www.supermicro.com/en/support/security_BMC_IPMI_Jan_2025

Source: def9a96e-e099-41a9-bfac-30fd4f82c411

Timeline

No history available yet.