CVE-2023-35861

Q: What is the severity of CVE-2023-35861?

CVE-2023-35861 has a CVSS score of 9.8 (CRITICAL). CVE-2023-35861 is a shell injection vulnerability in Supermicro motherboard BMC email notifications that allows remote attackers to execute arbitrary commands as root. This affects Supermicro H12DST-B motherboards with BMC firmware before version 03.10.35. Attackers can gain complete control over the BMC, which manages the server hardware.

9.8 CRITICAL

Remote Code Execution

📋 TL;DR

CVE-2023-35861 is a shell injection vulnerability in Supermicro motherboard BMC email notifications that allows remote attackers to execute arbitrary commands as root. This affects Supermicro H12DST-B motherboards with BMC firmware before version 03.10.35. Attackers can gain complete control over the BMC, which manages the server hardware.

💻 Affected Systems

Products:

Supermicro H12DST-B motherboards

Versions: BMC firmware versions before 03.10.35

Operating Systems: Any OS running on affected motherboards

Default Config Vulnerable: ⚠️ Yes

Notes: Vulnerability exists in BMC firmware, independent of host operating system. Requires SMTP/email notification feature to be configured.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of BMC with root access, allowing attackers to install persistent backdoors, manipulate hardware settings, intercept traffic, or brick the server.

🟠

Likely Case

Remote code execution leading to data theft, lateral movement within the network, or cryptomining deployment.

🟢

If Mitigated

Limited impact if network segmentation isolates BMC interfaces and strict access controls are implemented.

🌐 Internet-Facing: HIGH - BMC interfaces exposed to internet are directly exploitable without authentication.

🏢 Internal Only: HIGH - Even internally, any network access to BMC interface can lead to compromise.

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploit requires network access to BMC interface. Public technical details available in security blogs.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: BMC firmware 03.10.35 or later

Vendor Advisory: https://www.supermicro.com/en/support/security_SMTP_Jun_2023

Restart Required: Yes

Instructions:

1. Download latest BMC firmware from Supermicro support site. 2. Log into BMC web interface. 3. Navigate to Maintenance > Firmware Update. 4. Upload and apply firmware update. 5. Reboot BMC after update completes.

🔧 Temporary Workarounds

Disable SMTP/Email Notifications

linux

Temporarily disable email notification feature to prevent exploitation vector

ipmitool raw 0x32 0x6a 0x20 0x00 0x00 0x00 0x00 0x00 0x00 0x00

Network Segmentation

all

Isolate BMC interfaces to dedicated management network

🧯 If You Can't Patch

Implement strict network access controls to BMC interfaces (firewall rules, VLAN segmentation)
Disable SMTP/email notification functionality in BMC settings

🔍 How to Verify

Check if Vulnerable:

Check BMC firmware version via web interface or IPMI command: ipmitool mc info | grep 'Firmware Revision'

Check Version:

ipmitool mc info | grep 'Firmware Revision'

Verify Fix Applied:

Confirm firmware version is 03.10.35 or higher using same command

📡 Detection & Monitoring

Log Indicators:

Unusual BMC login attempts
SMTP configuration changes in BMC logs
Unexpected command execution in BMC audit logs

Network Indicators:

Unusual traffic to BMC IPMI port (623/UDP, 443/TCP)
SMTP traffic from BMC to unexpected destinations

SIEM Query:

source="BMC" AND (event="configuration_change" OR event="command_execution")

📊 Metadata

CVE ID: CVE-2023-35861

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-78

Published: July 31, 2023

Last Updated: November 21, 2024

🔗 References

https://blog.freax13.de/cve/cve-2023-35861 Exploit,Third Party Advisory
https://www.supermicro.com/en/products/motherboards Product
https://www.supermicro.com/en/support/security_SMTP_Jun_2023 Vendor Advisory
https://blog.freax13.de/cve/cve-2023-35861 Exploit,Third Party Advisory
https://www.supermicro.com/en/products/motherboards Product
https://www.supermicro.com/en/support/security_SMTP_Jun_2023 Vendor Advisory

📋 TL;DR

💻 Affected Systems

📦 What is this software?

H12dgo 6 Firmware by Supermicro

H12dgq Nt6 Firmware by Supermicro

H12dsg O Cpu Firmware by Supermicro

H12dsg Q Cpu6 Firmware by Supermicro

H12dsi N6 Firmware by Supermicro

H12dsi Nt6 Firmware by Supermicro

H12dst B Firmware by Supermicro

H12dst B Firmware by Supermicro

H12dsu In Firmware by Supermicro

H12dsu Inr Firmware by Supermicro

H12ssff An6 Firmware by Supermicro

H12ssfr An6 Firmware by Supermicro

H12ssg An6 Firmware by Supermicro

H12ssg Anp6 Firmware by Supermicro

H12ssl C Firmware by Supermicro

H12ssl Ct Firmware by Supermicro

H12ssl I Firmware by Supermicro

H12ssl Nt Firmware by Supermicro

H12sst Ps Firmware by Supermicro

H12ssw An6 Firmware by Supermicro

H12ssw In Firmware by Supermicro

H12ssw Inl Firmware by Supermicro

H12ssw Inr Firmware by Supermicro

H12ssw Nt Firmware by Supermicro

H12ssw Ntl Firmware by Supermicro

H12ssw Ntr Firmware by Supermicro

H13dsg O Cpu D Firmware by Supermicro

H13dsg O Cpu Firmware by Supermicro

H13dsh Firmware by Supermicro

H13sae Mf Firmware by Supermicro

H13srd F Firmware by Supermicro

H13ssf Firmware by Supermicro

H13ssh Firmware by Supermicro

H13ssl N Firmware by Supermicro

H13ssl Nt Firmware by Supermicro

H13sst G Firmware by Supermicro

H13sst Gc Firmware by Supermicro

H13ssw Firmware by Supermicro

X12dai N6 Firmware by Supermicro

X12ddw A6 Firmware by Supermicro

X12dgo 6 Firmware by Supermicro

X12dgq R Firmware by Supermicro

X12dgu Firmware by Supermicro

X12dhm 6 Firmware by Supermicro

X12dpd A6m25 Firmware by Supermicro

X12dpfr An6 Firmware by Supermicro

X12dpg Ar Firmware by Supermicro

X12dpg Oa6 Firmware by Supermicro

X12dpg Oa6 Gd2 Firmware by Supermicro

X12dpg Qbt6 Firmware by Supermicro

X12dpg Qr Firmware by Supermicro

X12dpg Qt6 Firmware by Supermicro

X12dpg U6 Firmware by Supermicro

X12dpi N6 Firmware by Supermicro

X12dpi Nt6 Firmware by Supermicro

X12dpl I6 Firmware by Supermicro

X12dpl Nt6 Firmware by Supermicro

X12dpt B6 Firmware by Supermicro

X12dpt Pt46 Firmware by Supermicro

X12dpt Pt6 Firmware by Supermicro

X12dpu 6 Firmware by Supermicro

X12dsc 6 Firmware by Supermicro

X12qch\+ Firmware by Supermicro

X12sae 5 Firmware by Supermicro

X12sae Firmware by Supermicro

X12sca 5f Firmware by Supermicro

X12sca F Firmware by Supermicro

X12scq Firmware by Supermicro

X12scv Lvds Firmware by Supermicro

X12scv W Firmware by Supermicro

X12scz F Firmware by Supermicro

X12scz Qf Firmware by Supermicro

X12scz Tln4f Firmware by Supermicro

X12sdv 10c Sp6f Firmware by Supermicro

X12sdv 10c Spt4f Firmware by Supermicro

X12sdv 14c Spt8f Firmware by Supermicro

X12sdv 16c Spt8f Firmware by Supermicro