What’s Vulnerable › Vulnerabilities

CVE-2023-35861

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2023-07-31 · updated 2026-06-17
• Weakness: CWE-78

Description

A shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before 03.10.35) allows remote attackers to inject execute arbitrary commands as root on the BMC.

Affected products

• Supermicro H12Dgo-6 Firmware: all versions
• Supermicro H12Dgq-Nt6 Firmware: all versions
• Supermicro H12Dsg-O-Cpu Firmware: all versions
• Supermicro H12Dsg-Q-Cpu6 Firmware: all versions
• Supermicro H12Dsi-N6 Firmware: all versions
• Supermicro H12Dsi-Nt6 Firmware: all versions
• Supermicro H12Dst-B Firmware: before 03.10.35 — fixed in 03.10.35
• Supermicro H12Dsu-In Firmware: all versions
• Supermicro H12Dsu-Inr Firmware: all versions
• Supermicro H12Ssff-An6 Firmware: all versions
• Supermicro H12Ssfr-An6 Firmware: all versions
• Supermicro H12Ssg-An6 Firmware: all versions
• Supermicro H12Ssg-Anp6 Firmware: all versions
• Supermicro H12Ssl-C Firmware: all versions
• Supermicro H12Ssl-Ct Firmware: all versions
• Supermicro H12Ssl-I Firmware: all versions
• Supermicro H12Ssl-Nt Firmware: all versions
• Supermicro H12Sst-Ps Firmware: all versions
• Supermicro H12Ssw-An6 Firmware: all versions
• Supermicro H12Ssw-In Firmware: all versions
• Supermicro H12Ssw-Inl Firmware: all versions
• Supermicro H12Ssw-Inr Firmware: all versions
• Supermicro H12Ssw-Nt Firmware: all versions
• Supermicro H12Ssw-Ntl Firmware: all versions
• Supermicro H12Ssw-Ntr Firmware: all versions
• Supermicro H13Dsg-O-Cpu-D Firmware: all versions
• Supermicro H13Dsg-O-Cpu Firmware: all versions
• Supermicro H13Dsh Firmware: all versions
• Supermicro H13Sae-Mf Firmware: all versions
• Supermicro H13Srd-F Firmware: all versions

How to fix

Upgrade to a fixed version: Supermicro H12Dst-B Firmware 03.10.35. Check the vendor advisory for mitigations.

References

• https://blog.freax13.de/cve/cve-2023-35861
• https://www.supermicro.com/en/products/motherboards
• https://www.supermicro.com/en/support/security_SMTP_Jun_2023
• https://blog.freax13.de/cve/cve-2023-35861
• https://www.supermicro.com/en/products/motherboards
• https://www.supermicro.com/en/support/security_SMTP_Jun_2023

Get alerted when CVE-2023-35861 or the next vulnerability affects your stack