Super Micro Computer, Inc. manufactures server hardware and embedded systems management platforms that span a large product portfolio, predominantly centered on its X11 server line and associated firmware components, which occupy a critical position in data-center infrastructure. Vulnerabilities affecting the vendor skew toward serious outcomes, with an elevated share reaching critical severity and a frequent tendency toward public exploit availability, reflecting the remote-access and administrative-interface character of baseboard-management and firmware-update mechanisms. The exposure recurs across the X11 server product family through weakness classes including cross-site scripting, memory-buffer boundary violations, improper authentication, and insufficient input validation—vulnerabilities that are particularly consequential in out-of-band management interfaces where firmware-level access can compromise entire systems below the operating-system layer. Defenders should prioritize inventory and network segmentation of affected server generations and treat management-interface patches as security-critical rather than maintenance-tier; current severity, exploitation activity, and CVE counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Super Micro Computer, Inc. over time
Of all the CVEs published by Super Micro Computer, Inc. as a CNA, 0.0% affect products that Super Micro Computer, Inc. develops as a vendor.
Of all the CVEs published that affect products developed by Super Micro Computer, Inc., 0.0% are self-published by Super Micro Computer, Inc. as a CNA.
Signals from CVEs in this vendor scope (29 CVEs).
29 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2013-3623HIGH Multiple stack-based buffer overflows in cgi/close_window.cgi in the web interface in the Intelligent Platform Management Interface (IPMI) with firmware before 3.15 (SMT_X9_315) on | Dec 10, 2013 | 10.0 | 80 | NO | YES |
CVE-2013-4782HIGH The Supermicro BMC implementation allows remote attackers to bypass authentication and execute arbitrary IPMI commands by using cipher suite 0 (aka cipher zero) and an arbitrary pa | Jul 8, 2013 | 10.0 | 49 | NO | YES |
CVE-2019-19642HIGH On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who can send HTTP reques | Dec 8, 2019 | 8.8 | 37 | NO | NO |
CVE-2013-3619HIGH Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before SMT_X9_317 and firmware for Supermicro X8 generation motherboards be | Jan 2, 2020 | 8.1 | 34 | NO | YES |
CVE-2020-15046HIGH The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 allows remote attackers to exploit a cgi/config_user.cgi CSRF issue to add new admin u | Jun 24, 2020 | 8.8 | 32 | NO | YES |
CVE-2023-40289HIGH A command injection issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker can exploit this to elevate privileges from a user with BMC admini | Mar 27, 2024 | 7.2 | 31 | NO | NO |
CVE-2019-16650CRITICAL On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number. In opportunistic ci | Sep 21, 2019 | 10.0 | 31 | NO | NO |
CVE-2019-16649CRITICAL On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of BMC credentials and d | Sep 21, 2019 | 10.0 | 30 | NO | NO |
CVE-2019-13131CRITICAL Super Micro SuperDoctor 5, when restrictions are not implemented in agent.cfg, allows remote attackers to execute arbitrary commands via NRPE. | Jul 1, 2019 | 9.8 | 30 | NO | NO |
CVE-2023-35861CRITICAL A shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before 03.10.35) allows remote attackers to inject execute arbitrary commands as | Jul 31, 2023 | 9.8 | 28 | NO | NO |
Signals from CVEs in this vendor scope (29 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Super Micro Computer, Inc..
Media articles that mention a CVE ID that affects a product developed by Super Micro Computer, Inc. — matched by CVE ID, not by vendor name.