CVE-2026-3820
Received
Received - Intake
Supermicro BMC SMTP Service Command Injection
Publication date: 2026-06-04
Last updated on: 2026-06-04
Assigner: Super Micro Computer, Inc.
Description
Description
There is a vulnerability in the Supermicro BMC SMTP service at Supermicro AS-2115HS-TNR.
An attacker may obtain administrator privileges and inject specially crafted characters into the SMTP service configuration. This may cause the underlying system to execute unintended commands during process invocation.
Potential impact includes denial-of-service attacks, arbitrary code execution, or permanent compromise of the controller.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| supermicro | as-2115hs-tnr | * |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-78 | The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Supermicro BMC SMTP service on the Supermicro AS-2115HS-TNR device. An attacker can exploit it by injecting specially crafted characters into the SMTP service configuration, which may allow them to gain administrator privileges.
As a result, the attacker could cause the system to execute unintended commands during process invocation.
How can this vulnerability impact me? :
The potential impacts of this vulnerability include denial-of-service attacks, arbitrary code execution, and permanent compromise of the controller.
Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70