What’s Vulnerable › Vulnerabilities

CVE-2013-3607

• Severity: critical (CVSS 10.0 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 9.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2013-09-08 · updated 2026-06-16
• Weakness: CWE-119

Description

Multiple stack-based buffer overflows in the web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-*, X9DB*, X9DR*, X9QR*, X9SBAA-F, X9SC*, X9SPU-F, and X9SR* devices allow remote attackers to execute arbitrary code on the Baseboard Management Controller (BMC), as demonstrated by the (1) username or (2) password field in login.cgi.

Affected products

• Supermicro H8Dcl-6F: all versions
• Supermicro H8Dcl-If: all versions
• Supermicro H8Dct-Hibqf: all versions
• Supermicro H8Dct-Hln4F: all versions
• Supermicro H8Dct-Ibqf: all versions
• Supermicro H8Dg6-F: all versions
• Supermicro H8Dgg-Qf: all versions
• Supermicro H8Dgi-F: all versions
• Supermicro H8Dgt-Hf: all versions
• Supermicro H8Dgt-Hibqf: all versions
• Supermicro H8Dgt-Hlf: all versions
• Supermicro H8Dgt-Hlibqf: all versions
• Supermicro H8Dgu-F: all versions
• Supermicro H8Dgu-Ln4F+: all versions
• Supermicro H8Scm-F: all versions
• Supermicro H8Sgl-F: all versions
• Supermicro H8Sme-F: all versions
• Supermicro H8Sml-7: all versions
• Supermicro H8Sml-7F: all versions
• Supermicro H8Sml-I: all versions
• Supermicro H8Sml-If: all versions
• Supermicro X7Spa-Hf: all versions
• Supermicro X7Spa-Hf-D525: all versions
• Supermicro X7Spe-H-D525: all versions
• Supermicro X7Spe-Hf: all versions
• Supermicro X7Spe-Hf-D525: all versions
• Supermicro X7Spt-Df-D525: all versions
• Supermicro X7Spt-Df-D525+: all versions
• Supermicro X8Dtl-3F: all versions
• Supermicro X8Dtl-6F: all versions

References

• http://www.kb.cert.org/vuls/id/648646
• http://www.securityfocus.com/bid/62094
• http://www.supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf
• http://www.thomas-krenn.com/en/wiki/Supermicro_IPMI_Security_Updates_November_2013
• https://support.citrix.com/article/CTX216642
• https://www.usenix.org/system/files/conference/woot13/woot13-bonkoski_0.pdf
• http://www.kb.cert.org/vuls/id/648646
• http://www.securityfocus.com/bid/62094
• http://www.supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf
• http://www.thomas-krenn.com/en/wiki/Supermicro_IPMI_Security_Updates_November_2013
• https://support.citrix.com/article/CTX216642
• https://www.usenix.org/system/files/conference/woot13/woot13-bonkoski_0.pdf

Get alerted when CVE-2013-3607 or the next vulnerability affects your stack