CVE-2026-18451: falha de baixa gravidade em SMCI MBD-X12SPI
Supermicro BMC's iKVM feature is vulnerable to KVM session hijacking due to a predictable time-seeded launch token
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 3.1epss 0.2%
The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Produtos afetados
SMCI · MBD-X12SPICVEs relacionadas — SMCI MBD-X12SPI
No mesmo produto, das mais perigosas para as menos.
CVE-2026-65213MEDIUMSupermicro BMC IPMI feature contains a Arbitrary Command Execution with Superuser Privileges vulnerabilityEPSS 0.5%CVE-2026-65219HIGHSupermicro BMC contains Unordered RAKP Message 3 Grants an IPMI Session vulnerabilityEPSS 0.5%CVE-2026-65211HIGHSupermicro BMC IPMI feature contains Critical Privilege Escalation and Arbitrary Access vulnerabilityEPSS 0.3%CVE-2026-65220HIGHSupermicro BMC IPMI feature contains a Privilege escalation vulnerabilityEPSS 0.3%CVE-2026-65210MEDIUMSupermicro BMC IPMI feature contains Arbitrary File Access vulnerabilityEPSS 0.2%