CVE-2025-12006CWE-347

Supermicro BMC firmware update validation bypass

High · published January 16, 2026

CVSS v3.1
7.2
EPSS
0%
Percentile
21.7
In the wild
Unconfirmed
What it is

⚡ A crafty firmware vulnerability in Supermicro's BMC could let an attacker update your system with a malicious image! 🔥 Think of it like a sneaky delivery service that swaps your order with one that has all the wrong ingredients — if they can get in, they can serve up something disastrous! An attacker could potentially replace the firmware with malicious code, leading to total system compromise. This isn't just a minor hiccup; your sensitive data could be at risk, and the attacker could gain control of the entire server!

Put simply

Think of it like a sneaky delivery service that swaps your order with one that has all the wrong ingredients — if they can get in, they can serve up something disastrous! This vulnerability arises from the BMC firmware validation logic in Supermicro MBD-X12STW, allowing attackers to upload a specially crafted firmware image without proper checks.

What to do

An attacker could potentially replace the firmware with malicious code, leading to total system compromise. This isn't just a minor hiccup; your sensitive data could be at risk, and the attacker could gain control of the entire server! Patch the firmware immediately to the latest version provided by Supermicro. Review your system access controls and monitor firmware updates closely to ensure they are from legitimate sources. Additionally, consider implementing stricter validation checks on firmware images. You've got this! With the right steps, you can safeguard your system against this threat! 🛡️

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00301 · 21.7th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-01-16T08:36Z
EPSS history
Timeline
  • 16 JAN 08:36Z
    Supermicro BMC firmware update validation bypass
    cvelistv5