What’s Vulnerable › Vulnerabilities

CVE-2013-3619

• Severity: high (CVSS 8.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 9.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-01-02 · updated 2026-06-16
• Weakness: CWE-798

Description

Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before SMT_X9_317 and firmware for Supermicro X8 generation motherboards before SMT X8 312 contain harcoded private encryption keys for the (1) Lighttpd web server SSL interface and the (2) Dropbear SSH daemon.

Affected products

• Citrix Netscaler Firmware: all versions
• Citrix Netscaler Sd-Wan Firmware: all versions
• Citrix Netscaler Sdx Firmware: 10 (and their updates)
• Supermicro Smt X8 Firmware: before 3.12 — fixed in 3.12
• Supermicro Smt X9 Firmware: before 3.15 — fixed in 3.15
• Supermicro IPMI: before SMT_X9_317 and before SMT X8 312

How to fix

Upgrade to a fixed version: Supermicro Smt X8 Firmware 3.12; Supermicro Smt X9 Firmware 3.15. Check the vendor advisory for mitigations.

References

• http://support.citrix.com/article/CTX216642
• https://community.rapid7.com/community/metasploit/blog/2013/11/05/supermicro-ipmi-firmware-vulnerabilities
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89044
• https://support.citrix.com/article/CTX216642
• https://www.supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf
• http://support.citrix.com/article/CTX216642
• https://community.rapid7.com/community/metasploit/blog/2013/11/05/supermicro-ipmi-firmware-vulnerabilities
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89044
• https://support.citrix.com/article/CTX216642
• https://www.supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf

Get alerted when CVE-2013-3619 or the next vulnerability affects your stack