Authenticated attackers can execute arbitrary code on SMCI X14DBG-DAP and X14DBI hardware via an OS command injection vulnerability.

The SMASH service improperly neutralizes special elements in OS commands, enabling authenticated users to perform command injection and achieve arbitrary code execution.

An attacker with authenticated access can leverage this vulnerability to take full control of the affected BMC or IPMI hardware. This level of access allows for persistent system compromise, potentially impacting the entire server infrastructure managed by the affected boards, warranting the high CVSS score of 8.8.

Immediate Action: Apply the vendor-provided security updates available through the official Supermicro support portal.

Proactive Monitoring: Monitor BMC/IPMI logs for anomalous command execution or administrative activity that deviates from established baselines.

Compensating Controls: Ensure that management interfaces are restricted to isolated management networks and are not exposed to the public internet.

Public Exploit Available: No

Administrators must verify the firmware versions on the affected hardware and apply the required security patches immediately. Failure to secure management interfaces can lead to severe operational and security compromises across the server fleet.