CVE-2023-35861
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk72th percentile - higher than 72% of all known CVEs
Summary
CVE-2023-35861 describes a shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before version 03.10.35) that allows remote attackers to inject and execute arbitrary commands as root on the BMC.
Risk Assessment
Attackers can remotely gain access to the system and execute unauthorized commands, potentially leading to serious security breaches within the organization.
Recommendation
It is recommended to update the firmware to the latest version to mitigate this vulnerability and to monitor systems for potential attack attempts.
Original NVD description (English source)
A shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before 03.10.35) allows remote attackers to inject execute arbitrary commands as root on the BMC.