CVE-2026-3820: Supermicro BMC's SMTP service contains a command injection vulnerability
There is a vulnerability in the Supermicro BMC SMTP service at Supermicro AS-2115HS-TNR. An attacker may obtain administrator privileges and inject specially crafted characters into the SMTP service configuration. This may cause the underlying system to execute unintended commands during process invocation.
Potential impact includes denial-of-service attacks, arbitrary code execution, or permanent compromise of the controller.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3820?
CVE-2026-3820 has a severity rating of high at 7.2.
How do I fix CVE-2026-3820?
To fix CVE-2026-3820, update the Supermicro BMC firmware to the latest version provided by Supermicro.
What type of vulnerability is CVE-2026-3820?
CVE-2026-3820 is classified as an OS Command Injection vulnerability.
What systems are affected by CVE-2026-3820?
CVE-2026-3820 affects the Supermicro AS-2115HS-TNR BMC systems.
What can an attacker achieve by exploiting CVE-2026-3820?
An attacker exploiting CVE-2026-3820 can obtain administrator privileges and execute unintended commands on the system.