CVE-2023-35861: Supermicro h12dgo-6 Firmware

Critical severity, CVSS 9.8. EPSS: 2.1% chance of exploitation in the next 30 days.

A shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before 03.10.35) allows remote attackers to inject execute arbitrary commands as root on the BMC.

Affected products

  • Supermicro h12dgo-6 Firmware: affected versions not specified
  • Supermicro h12dgq-NT6 Firmware: affected versions not specified
  • Supermicro h12dsg-O-CPU Firmware: affected versions not specified
  • Supermicro h12dsg-Q-CPU6 Firmware: affected versions not specified
  • Supermicro h12dsi-n6 Firmware: affected versions not specified
  • Supermicro h12dsi-NT6 Firmware: affected versions not specified
  • Supermicro h12dst-B Firmware: before 03.10.35 (fixed in 03.10.35); affected versions not specified
  • Supermicro h12dsu-In Firmware: affected versions not specified
  • Supermicro h12dsu-Inr Firmware: affected versions not specified
  • Supermicro h12ssff-AN6 Firmware: affected versions not specified
  • Supermicro h12ssfr-AN6 Firmware: affected versions not specified
  • Supermicro h12ssg-AN6 Firmware: affected versions not specified
  • Supermicro h12ssg-ANP6 Firmware: affected versions not specified
  • Supermicro h12ssl-C Firmware: affected versions not specified
  • Supermicro h12ssl-Ct Firmware: affected versions not specified
  • Supermicro h12ssl-I Firmware: affected versions not specified
  • Supermicro h12ssl-Nt Firmware: affected versions not specified
  • Supermicro h12sst-Ps Firmware: affected versions not specified
  • Supermicro h12ssw-AN6 Firmware: affected versions not specified
  • Supermicro h12ssw-In Firmware: affected versions not specified
  • Supermicro h12ssw-Inl Firmware: affected versions not specified
  • Supermicro h12ssw-Inr Firmware: affected versions not specified
  • Supermicro h12ssw-Nt Firmware: affected versions not specified
  • Supermicro h12ssw-Ntl Firmware: affected versions not specified
  • Supermicro h12ssw-Ntr Firmware: affected versions not specified
  • and 140 more

Published 2023-07-31. Last modified 2026-06-17.