CVE-2019-16650

3 documents3 sources
Severity
10.0CRITICAL
EPSS
0.7%
top 29.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
263
Supermicro A1sa2-2750f FirmwareSupermicro A1sai-2550f FirmwareSupermicro A1sai-2750f Firmware+260 more
Timeline
PublishedSep 21
Latest updateMay 24

Description

On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descriptor number. In opportunistic circumstances, an attacker can simply connect to the virtual media service, and then connect virtual USB devices to the server managed by the BMC.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HExploitability: 3.9 | Impact: 6.0

Affected Packages263 packages

🔴Vulnerability Details

2
GHSA
GHSA-vjvg-9vgw-x699: On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descript↗2022-05-24
▶
CVEList
CVE-2019-16650: On Supermicro X10 and X11 products, a client's access privileges may be transferred to a different client that later has the same socket file descript↗2019-09-21
▶
CVE-2019-16650 (CRITICAL CVSS 10) | On Supermicro X10 and X11 products | cvebase.io