CVE-2025-6198

Published Sep 19, 2025

Last updated 20 hours ago

Supermicro BMC

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-6198 is a vulnerability in the Supermicro BMC firmware validation logic found in Supermicro MBD-X13SEM-F. It allows an attacker to update the system firmware with a specially crafted image. This vulnerability exists because a crafted firmware image can bypass the Supermicro BMC firmware verification logic of the Signing Table. This is achieved by redirecting the program to a fake signing table ("sig_table") in the unsigned region. Successful exploitation of CVE-2025-6198 can bypass the BMC Root of Trust (RoT) security feature. This could allow attackers to gain persistent control of both the BMC system and the main server OS. Supermicro has released patches to address this vulnerability.

Description: There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X13SEM-F . An attacker can update the system firmware with a specially crafted image.
Source: def9a96e-e099-41a9-bfac-30fd4f82c411
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.2
Impact score: 5.9
Exploitability score: 1.2
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

def9a96e-e099-41a9-bfac-30fd4f82c411: CWE-347

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 1

References