CVE-2013-3609
The web interface in the Intelligent Platform Management Interface (IPMI) implementation on...
CVE-2013-3609 is a high vulnerability (CVSS 10.0) in Supermicro H8scm-f, published September 8, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.31%, the 92nd percentile. No source names a fixed version.
- Severity
- 10.0 HighCVSS 2.0, NVD
- Exploit chance
- 5.31%EPSS, 92nd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
The web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-, X9DB, X9DR*, X9QR*, X9SBAA-F, X9SC*, X9SPU-F, and X9SR* devices relies on JavaScript code on the client for authorization checks, which allows remote authenticated users to bypass intended access restrictions via a crafted request, related to the PrivilegeCallBack function.
Exploit likelihood
Affected products
- supermicro h8scm-f
- supermicro h8sgl-f
- supermicro x9sbaa-f
- supermicro x9spu-f
- supermicro h8dcl-6f
- supermicro h8dcl-if
- supermicro h8dct-hibqf
- supermicro h8dct-hln4f
- supermicro h8dct-ibqf
- supermicro h8dg6-f
- supermicro h8dgg-qf
- supermicro h8dgi-f
Show 121 moreShow less
- supermicro h8dgt-hf
- supermicro h8dgt-hibqf
- supermicro h8dgt-hlf
- supermicro h8dgt-hlibqf
- supermicro h8dgu-f
- supermicro h8dgu-ln4f\+
- supermicro h8sme-f
- supermicro h8sml-7
- supermicro h8sml-7f
- supermicro h8sml-i
- supermicro h8sml-if
- supermicro x7spa-hf
- supermicro x7spa-hf-d525
- supermicro x7spe-h-d525
- supermicro x7spe-hf
- supermicro x7spe-hf-d525
- supermicro x7spt-df-d525
- supermicro x7spt-df-d525\+
- supermicro x8dtl-3f
- supermicro x8dtl-6f
- supermicro x8dtl-if
- supermicro x8dtn\+-f
- supermicro x8dtn\+-f-lr
- supermicro x8dtu-6f\+
- supermicro x8dtu-6f\+-lr
- supermicro x8dtu-6tf\+
- supermicro x8dtu-6tf\+-lr
- supermicro x8dtu-ln4f\+
- supermicro x8dtu-ln4f\+-lr
- supermicro x8si6-f
- supermicro x8sia-f
- supermicro x8sie-f
- supermicro x8sie-ln4f
- supermicro x8sil-f
- supermicro x8sit-f
- supermicro x8sit-hf
- supermicro x8siu-f
- supermicro x9dax-7f
- supermicro x9dax-7f-hft
- supermicro x9dax-7tf
- supermicro x9dax-if
- supermicro x9dax-if-hft
- supermicro x9dax-itf
- supermicro x9db3-f
- supermicro x9db3-tpf
- supermicro x9dbi-f
- supermicro x9dbi-tpf
- supermicro x9dbl-3f
- supermicro x9dbl-if
- supermicro x9dbu-3f
- supermicro x9dbu-if
- supermicro x9dr3-f
- supermicro x9dr3-ln4f\+
- supermicro x9dr7-ln4f
- supermicro x9dr7-ln4f-jbod
- supermicro x9dr7-tf\+
- supermicro x9drd-7jln4f
- supermicro x9drd-7ln4f
- supermicro x9drd-7ln4f-jbod
- supermicro x9drd-ef
- supermicro x9drd-if
- supermicro x9dre-ln4f
- supermicro x9dre-tf\+
- supermicro x9drff
- supermicro x9drff-7
- supermicro x9drff-7\+
- supermicro x9drff-7g\+
- supermicro x9drff-7t\+
- supermicro x9drff-7tg\+
- supermicro x9drff-i\+
- supermicro x9drff-ig\+
- supermicro x9drff-it\+
- supermicro x9drff-itg\+
- supermicro x9drfr
- supermicro x9drg-hf
- supermicro x9drg-hf\+
- supermicro x9drg-htf
- supermicro x9drg-htf\+
- supermicro x9drh-7f
- supermicro x9drh-7tf
- supermicro x9drh-if
- supermicro x9drh-itf
- supermicro x9dri-f
- supermicro x9dri-ln4f\+
- supermicro x9drl-3f
- supermicro x9drl-ef
- supermicro x9drl-if
- supermicro x9drt-f
- supermicro x9drt-h6f
- supermicro x9drt-h6ibff
- supermicro x9drt-h6ibqf
- supermicro x9drt-hf\+
- supermicro x9drt-ibff
- supermicro x9drt-ibqf
- supermicro x9drw-3ln4f\+
- supermicro x9drw-3tf\+
- supermicro x9drw-7tpf\+
- supermicro x9drw-itpf\+
- supermicro x9drx\+-f
- supermicro x9qr7-tf
- supermicro x9qr7-tf-jbod
- supermicro x9qr7-tf\+
- supermicro x9qri-f
- supermicro x9qri-f\+
- supermicro x9sca-f
- supermicro x9scd-f
- supermicro x9sce-f
- supermicro x9scff-f
- supermicro x9sci-ln4f
- supermicro x9scl-f
- supermicro x9scl\+-f
- supermicro x9scm-f
- supermicro x9scm-iif
- supermicro x9srd-f
- supermicro x9sre-3f
- supermicro x9sre-f
- supermicro x9srg-f
- supermicro x9sri-3f
- supermicro x9sri-f
- supermicro x9srl-f
- supermicro x9srw-f
What each source reports
NVD Score used
The web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-, X9DB, X9DR*, X9QR*, X9SBAA-F, X9SC*, X9SPU-F, and X9SR* devices relies on JavaScript code on the client for authorization checks, which allows remote authenticated users to bypass intended access restrictions via a crafted request, related to the PrivilegeCallBack function.
- Record
CVE-2013-3609- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE ListNo score
The web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-, X9DB, X9DR*, X9QR*, X9SBAA-F, X9SC*, X9SPU-F, and X9SR* devices relies on JavaScript code on the client for authorization checks, which allows remote authenticated users to bypass intended access restrictions via a crafted request, related to the PrivilegeCallBack function.
- Record
CVE-2013-3609- Updated
- 2026-11-02
EUVDEUVD-2013-3543No score
The web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-, X9DB, X9DR*, X9QR*, X9SBAA-F, X9SC*, X9SPU-F, and X9SR* devices relies on JavaScript code on the client for authorization checks, which allows remote authenticated users to bypass intended access restrictions via a crafted request, related to the PrivilegeCallBack function.
- Record
EUVD-2013-3543- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-479j-fq45-9438No score
The web interface in the Intelligent Platform Management Interface (IPMI) implementation on...
The web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC*, H8DG*, H8SCM-F, H8SGL-F, H8SM*, X7SP*, X8DT*, X8SI*, X9DAX-, X9DB, X9DR*, X9QR*, X9SBAA-F, X9SC*, X9SPU-F, and X9SR* devices relies on JavaScript code on the client for authorization checks, which allows remote authenticated users to bypass intended access restrictions via a crafted request, related to the PrivilegeCallBack function.
- Record
GHSA-479j-fq45-9438- Weakness
- CWE-20
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
securityfocus.com/bid/62098
kb.cert.org/vuls/id/648646
supermicro.com/products/nfo/files/IPMI/CVE_Update.pdf
usenix.org/system/files/conference/woot13/woot13-bonkoski_0.pdf
thomas-krenn.com/en/wiki/Supermicro_IPMI_Security_Updates_November_2013
support.citrix.com/article/CTX216642
nvd.nist.gov/vuln/detail/CVE-2013-3609
github.com/advisories/GHSA-479j-fq45-9438