Vulnerability-Lookup

CVE-2026-3820 (GCVE-0-2026-3820)

Vulnerability from cvelistv5 – Published: 2026-06-04 08:07 – Updated: 2026-06-05 03:55

Title

Supermicro BMC's SMTP service contains a command injection vulnerability

Summary

There is a vulnerability in the Supermicro BMC SMTP service at Supermicro AS-2115HS-TNR. An attacker may obtain administrator privileges and inject specially crafted characters into the SMTP service configuration. This may cause the underlying system to execute unintended commands during process invocation. Potential impact includes denial-of-service attacks, arbitrary code execution, or permanent compromise of the controller.

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-78 - Improper neutralization of special elements used in an OS command ('OS command injection')

Assigner

Supermicro

References

1 reference

URL	Tags
https://www.supermicro.com/en/support/security_BM…

Impacted products

1 product

Vendor	Product	Version
SMCI	AS-2115HS-TNR	Affected: 01.08.01 Affected: 01.06.04

Credits

Coreweave Red Team and Hoang Bui from Coreweave

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-3820",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-04T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-05T03:55:50.915Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "platforms": [
            "BMC"
          ],
          "product": "AS-2115HS-TNR",
          "vendor": "SMCI",
          "versions": [
            {
              "status": "affected",
              "version": "01.08.01"
            },
            {
              "status": "affected",
              "version": "01.06.04"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Coreweave Red Team and Hoang Bui from Coreweave"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "There is a vulnerability in the Supermicro BMC  SMTP service at Supermicro AS-2115HS-TNR.\u0026nbsp;\u003cbr\u003e\u003cspan\u003eAn attacker may obtain administrator privileges and inject specially crafted characters into the SMTP service configuration. This may cause the underlying system to execute unintended commands during process invocation.\u003c/span\u003e\u003cp\u003ePotential impact includes denial-of-service attacks, arbitrary code execution, or permanent compromise of the controller.\u003c/p\u003e"
            }
          ],
          "value": "There is a vulnerability in the Supermicro BMC  SMTP service at Supermicro AS-2115HS-TNR.\u00a0\nAn attacker may obtain administrator privileges and inject specially crafted characters into the SMTP service configuration. This may cause the underlying system to execute unintended commands during process invocation.\n\nPotential impact includes denial-of-service attacks, arbitrary code execution, or permanent compromise of the controller."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88 OS Command Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-04T08:07:57.608Z",
        "orgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
        "shortName": "Supermicro"
      },
      "references": [
        {
          "url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Jun_2026"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Supermicro BMC\u0027s SMTP service contains a command injection vulnerability",
      "x_generator": {
        "engine": "Vulnogram 1.0.2"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "def9a96e-e099-41a9-bfac-30fd4f82c411",
    "assignerShortName": "Supermicro",
    "cveId": "CVE-2026-3820",
    "datePublished": "2026-06-04T08:07:57.608Z",
    "dateReserved": "2026-03-09T02:52:12.355Z",
    "dateUpdated": "2026-06-05T03:55:50.915Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-3820",
      "date": "2026-06-05",
      "epss": "0.00072",
      "percentile": "0.2215"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-3820\",\"sourceIdentifier\":\"def9a96e-e099-41a9-bfac-30fd4f82c411\",\"published\":\"2026-06-04T09:16:28.980\",\"lastModified\":\"2026-06-04T16:40:28.363\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"There is a vulnerability in the Supermicro BMC  SMTP service at Supermicro AS-2115HS-TNR.\u00a0\\nAn attacker may obtain administrator privileges and inject specially crafted characters into the SMTP service configuration. This may cause the underlying system to execute unintended commands during process invocation.\\n\\nPotential impact includes denial-of-service attacks, arbitrary code execution, or permanent compromise of the controller.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"def9a96e-e099-41a9-bfac-30fd4f82c411\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"def9a96e-e099-41a9-bfac-30fd4f82c411\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"references\":[{\"url\":\"https://www.supermicro.com/en/support/security_BMC_IPMI_Jun_2026\",\"source\":\"def9a96e-e099-41a9-bfac-30fd4f82c411\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-3820\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-04T12:45:45.998787Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-04T12:45:53.461Z\"}}], \"cna\": {\"title\": \"Supermicro BMC\u0027s SMTP service contains a command injection vulnerability\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Coreweave Red Team and Hoang Bui from Coreweave\"}], \"impacts\": [{\"capecId\": \"CAPEC-88\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-88 OS Command Injection\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.2, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"SMCI\", \"product\": \"AS-2115HS-TNR\", \"versions\": [{\"status\": \"affected\", \"version\": \"01.08.01\"}, {\"status\": \"affected\", \"version\": \"01.06.04\"}], \"platforms\": [\"BMC\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://www.supermicro.com/en/support/security_BMC_IPMI_Jun_2026\"}], \"x_generator\": {\"engine\": \"Vulnogram 1.0.2\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"There is a vulnerability in the Supermicro BMC  SMTP service at Supermicro AS-2115HS-TNR.\\u00a0\\nAn attacker may obtain administrator privileges and inject specially crafted characters into the SMTP service configuration. This may cause the underlying system to execute unintended commands during process invocation.\\n\\nPotential impact includes denial-of-service attacks, arbitrary code execution, or permanent compromise of the controller.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"There is a vulnerability in the Supermicro BMC  SMTP service at Supermicro AS-2115HS-TNR.\u0026nbsp;\u003cbr\u003e\u003cspan\u003eAn attacker may obtain administrator privileges and inject specially crafted characters into the SMTP service configuration. This may cause the underlying system to execute unintended commands during process invocation.\u003c/span\u003e\u003cp\u003ePotential impact includes denial-of-service attacks, arbitrary code execution, or permanent compromise of the controller.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-78\", \"description\": \"CWE-78 Improper neutralization of special elements used in an OS command (\u0027OS command injection\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"def9a96e-e099-41a9-bfac-30fd4f82c411\", \"shortName\": \"Supermicro\", \"dateUpdated\": \"2026-06-04T08:07:57.608Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-3820\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-06-05T03:55:50.915Z\", \"dateReserved\": \"2026-03-09T02:52:12.355Z\", \"assignerOrgId\": \"def9a96e-e099-41a9-bfac-30fd4f82c411\", \"datePublished\": \"2026-06-04T08:07:57.608Z\", \"assignerShortName\": \"Supermicro\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-3820

Vulnerability from fkie_nvd - Published: 2026-06-04 09:16 - Updated: 2026-06-04 16:40

Severity

7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	def9a96e-e099-41a9-bfac-30fd4f82c411	https://www.supermicro.com/en/support/security_BMC_IPMI_Jun_2026

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "There is a vulnerability in the Supermicro BMC  SMTP service at Supermicro AS-2115HS-TNR.\u00a0\nAn attacker may obtain administrator privileges and inject specially crafted characters into the SMTP service configuration. This may cause the underlying system to execute unintended commands during process invocation.\n\nPotential impact includes denial-of-service attacks, arbitrary code execution, or permanent compromise of the controller."
    }
  ],
  "id": "CVE-2026-3820",
  "lastModified": "2026-06-04T16:40:28.363",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "def9a96e-e099-41a9-bfac-30fd4f82c411",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-06-04T09:16:28.980",
  "references": [
    {
      "source": "def9a96e-e099-41a9-bfac-30fd4f82c411",
      "url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Jun_2026"
    }
  ],
  "sourceIdentifier": "def9a96e-e099-41a9-bfac-30fd4f82c411",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "def9a96e-e099-41a9-bfac-30fd4f82c411",
      "type": "Secondary"
    }
  ]
}

GHSA-WP43-6FH8-Q2QR

Vulnerability from github – Published: 2026-06-04 09:30 – Updated: 2026-06-04 09:30

Details

Potential impact includes denial-of-service attacks, arbitrary code execution, or permanent compromise of the controller.

Severity

7.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-3820"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-04T09:16:28Z",
    "severity": "HIGH"
  },
  "details": "There is a vulnerability in the Supermicro BMC  SMTP service at Supermicro AS-2115HS-TNR.\u00a0\nAn attacker may obtain administrator privileges and inject specially crafted characters into the SMTP service configuration. This may cause the underlying system to execute unintended commands during process invocation.\n\nPotential impact includes denial-of-service attacks, arbitrary code execution, or permanent compromise of the controller.",
  "id": "GHSA-wp43-6fh8-q2qr",
  "modified": "2026-06-04T09:30:35Z",
  "published": "2026-06-04T09:30:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3820"
    },
    {
      "type": "WEB",
      "url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Jun_2026"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-3820 (GCVE-0-2026-3820)

FKIE_CVE-2026-3820

GHSA-WP43-6FH8-Q2QR

Tags

Sightings

Nomenclature