CVE-2019-16649

Q: What is the severity of CVE-2019-16649?

CVE-2019-16649 has a CVSS score of 10.0 (CRITICAL). This vulnerability in Supermicro BMC firmware allows attackers to capture BMC credentials and data transferred over virtual media devices due to encryption and authentication flaws. Attackers can then use these credentials to remotely connect virtual USB devices to servers managed by the BMC. Affected products include Supermicro H11, H12, M11, X9, X10, and X11 series servers with vulnerable BMC firmware.

10.0 CRITICAL

📋 TL;DR

This vulnerability in Supermicro BMC firmware allows attackers to capture BMC credentials and data transferred over virtual media devices due to encryption and authentication flaws. Attackers can then use these credentials to remotely connect virtual USB devices to servers managed by the BMC. Affected products include Supermicro H11, H12, M11, X9, X10, and X11 series servers with vulnerable BMC firmware.

💻 Affected Systems

Products:

Supermicro H11
H12
M11
X9
X10
X11 series servers

Versions: BMC firmware versions prior to patched versions (varies by model)

Operating Systems: Any OS running on affected servers

Default Config Vulnerable: ⚠️ Yes

Notes: Requires virtual media service to be enabled (often default).

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Full server compromise allowing attackers to install malware, exfiltrate data, or cause physical damage through virtual USB device connections.

🟠

Likely Case

Credential theft leading to unauthorized BMC access and potential server manipulation.

🟢

If Mitigated

Limited impact if network segmentation and strong authentication are in place.

🌐 Internet-Facing: HIGH - BMC interfaces exposed to internet are directly exploitable.

🏢 Internal Only: HIGH - Internal attackers can exploit this to gain privileged access.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: CONFIRMED

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploit tools available on GitHub. Attack requires network access to BMC interface.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Varies by model - check Supermicro security advisory for specific versions

Vendor Advisory: https://www.supermicro.com/support/security_BMC_virtual_media.cfm

Restart Required: Yes

Instructions:

1. Identify server model and current BMC firmware version. 2. Download appropriate patched firmware from Supermicro support site. 3. Update BMC firmware following Supermicro documentation. 4. Verify update completed successfully.

🔧 Temporary Workarounds

Disable Virtual Media Service

linux

Temporarily disable the vulnerable virtual media service until patching can be completed.

ipmitool raw 0x32 0x6a 0x20 0x00 0x00 0x00 0x00 0x00 0x00 0x00

Network Segmentation

all

Isolate BMC management interfaces from untrusted networks.

🧯 If You Can't Patch

Implement strict network access controls to BMC interfaces
Disable virtual media service entirely if not required

🔍 How to Verify

Check if Vulnerable:

Check BMC firmware version against Supermicro's patched versions list. Use ipmitool: ipmitool mc info | grep 'Firmware Revision'

Check Version:

ipmitool mc info | grep 'Firmware Revision'

Verify Fix Applied:

Verify BMC firmware version matches patched version from Supermicro advisory. Test virtual media functionality to ensure it still works securely.

📡 Detection & Monitoring

Log Indicators:

Unusual virtual media connection attempts in BMC logs
Failed authentication attempts followed by successful connections

Network Indicators:

Unexpected traffic to BMC virtual media ports (typically 623/UDP, 5900/TCP)
Network scans targeting BMC interfaces

SIEM Query:

source="BMC_logs" AND ("virtual media" OR "USB redirection") AND status="success"

📊 Metadata

CVE ID: CVE-2019-16649

CVSS v3 Score: 10.0 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE: CWE-287

Published: September 21, 2019

Last Updated: November 21, 2024

🔗 References

https://eclypsium.com/2019/09/03/usbanywhere-bmc-vulnerability-opens-servers-to-remote-attack/ Third Party Advisory
https://github.com/eclypsium/USBAnywhere Third Party Advisory
https://www.supermicro.com/support/security_BMC_virtual_media.cfm Vendor Advisory
https://eclypsium.com/2019/09/03/usbanywhere-bmc-vulnerability-opens-servers-to-remote-attack/ Third Party Advisory
https://github.com/eclypsium/USBAnywhere Third Party Advisory
https://www.supermicro.com/support/security_BMC_virtual_media.cfm Vendor Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

A1sa2 2750f Firmware by Supermicro

A1sai 2550f Firmware by Supermicro

A1sai 2750f Firmware by Supermicro

A1sam 2550f Firmware by Supermicro

A1sam 2750f Firmware by Supermicro

A1sri 2358f Firmware by Supermicro

A1sri 2558f Firmware by Supermicro

A1sri 2758f Firmware by Supermicro

A1srm 2558f Firmware by Supermicro

A1srm 2758f Firmware by Supermicro

A1srm Ln5f 2358 Firmware by Supermicro

A1srm Ln7f 2358 Firmware by Supermicro

A1srm Ln7f 2758 Firmware by Supermicro

B10drc Firmware by Supermicro

B10drc N Firmware by Supermicro

B10drg Ibf Firmware by Supermicro

B10drg Ibf2 Firmware by Supermicro

B10drg Tp Firmware by Supermicro

B10dri Firmware by Supermicro

B10dri N Firmware by Supermicro

B10drt Firmware by Supermicro

B10drt Ibf Firmware by Supermicro

B10drt Ibf2 Firmware by Supermicro

B10drt Tp Firmware by Supermicro

B11dpe Firmware by Supermicro

B11dpt Firmware by Supermicro

B11qpi Firmware by Supermicro

B11spe Cpu 25g Firmware by Supermicro

B11spe Cpu Tf Firmware by Supermicro

B1sd1 16c Tf Firmware by Supermicro

B1sd1 Tf Firmware by Supermicro

B1sd2 16c Tf Firmware by Supermicro

B1sd2 Tf Firmware by Supermicro

B2ss1 Cf Firmware by Supermicro

B2ss1 Cpu Firmware by Supermicro

B2ss1 F Firmware by Supermicro

B2ss1 H Mtf Firmware by Supermicro

B2ss1 Mtf Firmware by Supermicro

B2ss2 F Firmware by Supermicro

B2ss2 H Mtf Firmware by Supermicro

B2ss2 Mtf Firmware by Supermicro

B9dr7 Firmware by Supermicro

B9drg 3m Firmware by Supermicro

B9drg E Firmware by Supermicro

B9drg Firmware by Supermicro

B9dri Firmware by Supermicro

B9drp Firmware by Supermicro

B9drt Firmware by Supermicro

B9qr7\( Tp\) Firmware by Supermicro

M11sdv 4c Ln4f Firmware by Supermicro

M11sdv 4ct Ln4f Firmware by Supermicro

M11sdv 8c Ln4f Firmware by Supermicro

M11sdv 8c Ln4f Firmware by Supermicro

M11sdv 8ct Ln4f Firmware by Supermicro

X10dbt T Firmware by Supermicro

X10ddw I Firmware by Supermicro

X10ddw In Firmware by Supermicro

X10dgo T Firmware by Supermicro

X10dgq Firmware by Supermicro

X10drc Ln4\+ Firmware by Supermicro

X10drc T4\+ Firmware by Supermicro

X10drd I Firmware by Supermicro

X10drd Int Firmware by Supermicro

X10drd Intp Firmware by Supermicro

X10drd It Firmware by Supermicro

X10drd Itp Firmware by Supermicro

X10drd L Firmware by Supermicro

X10drd Lt Firmware by Supermicro

X10drd Ltp Firmware by Supermicro

X10drff C Firmware by Supermicro

X10drff Cg Firmware by Supermicro

X10drff Ctg Firmware by Supermicro

X10drff Firmware by Supermicro

X10drff Ig Firmware by Supermicro

X10drff Itg Firmware by Supermicro

X10drfr Firmware by Supermicro

X10drfr N Firmware by Supermicro