CVE-2023-40288

HighCVSS 8.3/10Last modified Jun 17, 2026

Description

An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a
supermicro	x11ssm-f_firmware	1.66
supermicro	x11sae-f_firmware	1.66
supermicro	x11sse-f_firmware	1.66

References

https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023Vendor Advisory
https://www.supermicro.com/en/support/security_center#%21advisoriesVendor Advisory
https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2023Vendor Advisory
https://www.supermicro.com/en/support/security_center#%21advisoriesVendor Advisory

Timeline

Published: Mar 27, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-402897.2A command injection issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker can exploit this to elevat CVE-2023-40296.7A buffer overflow has been identified in the BoardUpdateAcpiDxe driver in some Lenovo ThinkPad products which may allow an attacker with loc CVE-2023-402908.3An issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. An attacker could exploit an XSS issue that affects Int CVE-2023-402916.8Harman Infotainment 20190525031613 allows root access via SSH over a USB-to-Ethernet dongle with a password that is an internal project name CVE-2023-402924.3Harman Infotainment 20190525031613 and later discloses the IP address via CarPlay CTRL packets.CVE-2023-402936.8Harman Infotainment 20190525031613 and later allows command injection via unauthenticated RPC with a D-Bus connection object.CVE-2023-402946.5libboron in Boron 2.0.8 has a heap-based buffer overflow in ur_parseBlockI at i_parse_blk.c.CVE-2023-402958.8libboron in Boron 2.0.8 has a heap-based buffer overflow in ur_strInitUtf8 at string.c.CVE-2023-402967.5async-sockets-cpp through 0.3.1 has a stack-based buffer overflow in ReceiveFrom and Receive in udpsocket.hpp when processing malformed UDP CVE-2023-402977.5Stakater Forecastle 1.0.139 and before allows %5C../ directory traversal in the website component.CVE-2023-402997.8Kong Insomnia 2023.4.0 on macOS allows attackers to execute code and access restricted files, or make requests for TCC permissions, by using CVE-2023-40307.8A vulnerability was reported in BIOS for ThinkPad P14s Gen 2, P15s Gen 2, T14 Gen 2, and T15 Gen 2 that could cause the system to recover to