Skip to content
CVE PROGRAM SOURCE RECORD3.1 Low

CVE-2026-18451

Supermicro BMC's iKVM feature is vulnerable to KVM session hijacking due to a predictable time-seeded launch token

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Supermicro

Description

The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SMCI MBD-X12SPI

Default version status: affected

  • 01.07.20affected

References