CVE-2025-8727 - Vulnerability Details - OpenCVE

ReportizFlow

There is a vulnerability in the Supermicro BMC web function at Supermicro MBD-X13SEDW-F. After logging into the BMC Web server, an attacker can use a specially crafted payload to trigger the Stack buffer overflow vulnerability.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Supermicro	Mbd-x13sedw-f

No data.

No data.

References

Link	Providers
https://www.supermicro.com/zh_tw/support/security_BMC_IPMI_Nov_2025

History

Wed, 19 Nov 2025 21:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 19 Nov 2025 11:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Supermicro Supermicro mbd-x13sedw-f
Vendors & Products		Supermicro Supermicro mbd-x13sedw-f

Tue, 18 Nov 2025 08:00:00 +0000

Type	Values Removed	Values Added
Description		There is a vulnerability in the Supermicro BMC web function at Supermicro MBD-X13SEDW-F. After logging into the BMC Web server, an attacker can use a specially crafted payload to trigger the Stack buffer overflow vulnerability.
Title		A stack buffer overflow vulnerability exists in the Supermicro BMC Web function(SSL).
Weaknesses		CWE-121
References		https://www.supermicro.com/zh_tw/support/security_BMC_IPMI_Nov_2025
Metrics		cvssV3_1 `{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: Supermicro

Published: 2025-11-18T07:52:09.494Z

Updated: 2025-11-19T16:49:01.793Z

Reserved: 2025-08-08T06:19:23.996Z

Link: CVE-2025-8727

Vulnrichment

Updated: 2025-11-18T15:04:00.597Z

NVD

Status : Awaiting Analysis

Published: 2025-11-18T08:15:51.980

Modified: 2025-11-18T14:06:29.817

Link: CVE-2025-8727

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8727", "assignerOrgId": "def9a96e-e099-41a9-bfac-30fd4f82c411", "state": "PUBLISHED", "assignerShortName": "Supermicro", "dateReserved": "2025-08-08T06:19:23.996Z", "datePublished": "2025-11-18T07:52:09.494Z", "dateUpdated": "2025-11-19T16:49:01.793Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["BMC"], "product": "X13SEDW-F", "vendor": "SMCI", "versions": [{"status": "affected", "version": "01.03.48"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Coreweave Red Team and Hoang Bui from Coreweave"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">There is a vulnerability in the Supermicro BMC web function at Supermicro MBD-X13SEDW-F. After logging into the BMC Web server, an attacker can use a specially crafted payload to trigger the Stack buffer overflow vulnerability.</span>"}], "value": "There is a vulnerability in the Supermicro BMC web function at Supermicro MBD-X13SEDW-F. After logging into the BMC Web server, an attacker can use a specially crafted payload to trigger the Stack buffer overflow vulnerability."}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-121", "description": "CWE-121: Stack-based Buffer Overflow", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "def9a96e-e099-41a9-bfac-30fd4f82c411", "shortName": "Supermicro", "dateUpdated": "2025-11-18T07:52:09.494Z"}, "references": [{"url": "https://www.supermicro.com/zh_tw/support/security_BMC_IPMI_Nov_2025"}], "source": {"discovery": "UNKNOWN"}, "title": "A stack buffer overflow vulnerability exists in the Supermicro BMC Web function(SSL).", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-19T04:55:25.585194Z", "id": "CVE-2025-8727", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-19T16:49:01.793Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"cna": {"title": "A stack buffer overflow vulnerability exists in the Supermicro BMC Web function(SSL).", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Coreweave Red Team and Hoang Bui from Coreweave"}], "impacts": [{"capecId": "CAPEC-100", "descriptions": [{"lang": "en", "value": "CAPEC-100 Overflow Buffers"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SMCI", "product": "X13SEDW-F", "versions": [{"status": "affected", "version": "01.03.48"}], "platforms": ["BMC"], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.supermicro.com/zh_tw/support/security_BMC_IPMI_Nov_2025"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "There is a vulnerability in the Supermicro BMC web function at Supermicro MBD-X13SEDW-F. After logging into the BMC Web server, an attacker can use a specially crafted payload to trigger the Stack buffer overflow vulnerability.", "supportingMedia": [{"type": "text/html", "value": "<span style=\"background-color: rgb(255, 255, 255);\">There is a vulnerability in the Supermicro BMC web function at Supermicro MBD-X13SEDW-F. After logging into the BMC Web server, an attacker can use a specially crafted payload to trigger the Stack buffer overflow vulnerability.</span>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-121", "description": "CWE-121: Stack-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "def9a96e-e099-41a9-bfac-30fd4f82c411", "shortName": "Supermicro", "dateUpdated": "2025-11-18T07:52:09.494Z"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8727", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-19T04:55:25.585194Z"}}}], "providerMetadata": {"shortName": "CISA-ADP", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "dateUpdated": "2025-11-18T15:04:00.597Z"}}]}, "cveMetadata": {"cveId": "CVE-2025-8727", "state": "PUBLISHED", "dateUpdated": "2025-11-18T07:52:09.494Z", "dateReserved": "2025-08-08T06:19:23.996Z", "assignerOrgId": "def9a96e-e099-41a9-bfac-30fd4f82c411", "datePublished": "2025-11-18T07:52:09.494Z", "assignerShortName": "Supermicro"}, "dataVersion": "5.2"}