Supermicro x10drh-It Firmware vulnerabilities

3 CVEs affecting Supermicro x10drh-It Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-15046, published 2020-06-24.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-15046, published 2020-06-24. High severity, CVSS 8.8. EPSS: 2.3% chance of exploitation in the next 30 days. The web interface on Supermicro X10DRH-iT motherboards with BIOS 2.0a and IPMI firmware 03.40 allows remote attackers to exploit a cgi/config_user.cgi CSRF issue to add new admin users. The fixed…
CVE-2019-16650, published 2019-09-21. Critical severity, CVSS 10.0. EPSS: 2.2% chance of exploitation in the next 30 days. On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number. In opportunistic circumstances, an…
CVE-2019-16649, published 2019-09-21. Critical severity, CVSS 10.0. EPSS: 0.9% chance of exploitation in the next 30 days. On Supermicro H11, H12, M11, X9, X10, and X11 products, a combination of encryption and authentication problems in the virtual media service allows capture of BMC credentials and data transferred…