CVE-2024-10237 - Vulnerability Details - OpenCVE

There is a vulnerability in the BMC firmware image authentication design at Supermicro MBD-X12DPG-OA6 . An attacker can modify the firmware to bypass BMC inspection and bypass the signature verification process

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

No data.

No data.

No data.

References

Link	Providers
https://www.supermicro.com/en/support/security_BMC_IPMI_Jan_2025

History

Tue, 15 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00022}`	epss `{'score': 0.00026}`

Tue, 04 Feb 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 04 Feb 2025 08:15:00 +0000

Type	Values Removed	Values Added
Description		There is a vulnerability in the BMC firmware image authentication design at Supermicro MBD-X12DPG-OA6 . An attacker can modify the firmware to bypass BMC inspection and bypass the signature verification process
Title		SMC BMC Firmware Image Authentication Design Issue
Weaknesses		CWE-345 CWE-347
References		https://www.supermicro.com/en/support/security_BMC_IPMI_Jan_2025
Metrics		cvssV3_1 `{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: Supermicro

Published: 2025-02-04T07:59:26.354Z

Updated: 2025-02-04T14:38:14.400Z

Reserved: 2024-10-22T03:14:14.274Z

Link: CVE-2024-10237

Vulnrichment

Updated: 2025-02-04T14:38:10.441Z

NVD

Status : Received

Published: 2025-02-04T08:15:27.920

Modified: 2025-02-04T08:15:27.920

Link: CVE-2024-10237

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-10237", "assignerOrgId": "def9a96e-e099-41a9-bfac-30fd4f82c411", "state": "PUBLISHED", "assignerShortName": "Supermicro", "dateReserved": "2024-10-22T03:14:14.274Z", "datePublished": "2025-02-04T07:59:26.354Z", "dateUpdated": "2025-02-04T14:38:14.400Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["BMC"], "product": "MBD-X12DPG-OA6", "vendor": "SMCI", "versions": [{"status": "affected", "version": "1.04.16", "versionType": "BMC"}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">There is a vulnerability in the BMC firmware image authentication design \n\n at Supermicro MBD-X12DPG-OA6\n\n. An attacker can modify the firmware to bypass BMC inspection and bypass the signature verification process</span>"}], "value": "There is a vulnerability in the BMC firmware image authentication design \n\n at Supermicro MBD-X12DPG-OA6\n\n. An attacker can modify the firmware to bypass BMC inspection and bypass the signature verification process"}], "impacts": [{"capecId": "CAPEC-137", "descriptions": [{"lang": "en", "value": "CAPEC-137: Parameter Injection"}]}, {"capecId": "CAPEC-166", "descriptions": [{"lang": "en", "value": "CAPEC-166: Forced Rewriting"}]}, {"capecId": "CAPEC-192", "descriptions": [{"lang": "en", "value": "CAPEC-192: Manipulation of Sensitive Data"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-347", "description": "CWE-347: Improper Verification of Cryptographic Signature", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-345", "description": "CWE-345: Insufficient Verification of Data Authenticity", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "def9a96e-e099-41a9-bfac-30fd4f82c411", "shortName": "Supermicro", "dateUpdated": "2025-02-04T07:59:26.354Z"}, "references": [{"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Jan_2025"}], "source": {"discovery": "UNKNOWN"}, "title": "SMC BMC Firmware Image Authentication Design Issue", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-04T14:38:05.372240Z", "id": "CVE-2024-10237", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-04T14:38:14.400Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-10237", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-04T14:38:05.372240Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-04T14:38:10.441Z"}}], "cna": {"title": "SMC BMC Firmware Image Authentication Design Issue", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-137", "descriptions": [{"lang": "en", "value": "CAPEC-137: Parameter Injection"}]}, {"capecId": "CAPEC-166", "descriptions": [{"lang": "en", "value": "CAPEC-166: Forced Rewriting"}]}, {"capecId": "CAPEC-192", "descriptions": [{"lang": "en", "value": "CAPEC-192: Manipulation of Sensitive Data"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SMCI", "product": "MBD-X12DPG-OA6", "versions": [{"status": "affected", "version": "1.04.16", "versionType": "BMC"}], "platforms": ["BMC"], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Jan_2025"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "There is a vulnerability in the BMC firmware image authentication design \n\n at Supermicro MBD-X12DPG-OA6\n\n. An attacker can modify the firmware to bypass BMC inspection and bypass the signature verification process", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">There is a vulnerability in the BMC firmware image authentication design \n\n at Supermicro MBD-X12DPG-OA6\n\n. An attacker can modify the firmware to bypass BMC inspection and bypass the signature verification process</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-347", "description": "CWE-347: Improper Verification of Cryptographic Signature"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-345", "description": "CWE-345: Insufficient Verification of Data Authenticity"}]}], "providerMetadata": {"orgId": "def9a96e-e099-41a9-bfac-30fd4f82c411", "shortName": "Supermicro", "dateUpdated": "2025-02-04T07:59:26.354Z"}}}, "cveMetadata": {"cveId": "CVE-2024-10237", "state": "PUBLISHED", "dateUpdated": "2025-02-04T14:38:14.400Z", "dateReserved": "2024-10-22T03:14:14.274Z", "assignerOrgId": "def9a96e-e099-41a9-bfac-30fd4f82c411", "datePublished": "2025-02-04T07:59:26.354Z", "assignerShortName": "Supermicro"}, "dataVersion": "5.1"}