CVE-2013-3619

Intelligent Platform Management Interface (IPMI) with firmware for Supermicro X9 generation motherboards before SMT_X9_317 and firmware for Supermicro X8 generation motherboards before SMT X8 312 contain harcoded private encryption keys for the (1) Lighttpd web server SSL interface and the (2) Dropbear SSH daemon.

• CWE-798

• http://support.citrix.com/article/CTX216642Third Party Advisory
• https://community.rapid7.com/community/metasploit/blog/2013/11/05/supermicro-ipmi-firmware-vulnerabilitiesThird Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89044Third Party Advisory, VDB Entry
• https://support.citrix.com/article/CTX216642Third Party Advisory
• https://www.supermicro.com/products/nfo/files/IPMI/CVE_Update.pdfVendor Advisory
• http://support.citrix.com/article/CTX216642Third Party Advisory
• https://community.rapid7.com/community/metasploit/blog/2013/11/05/supermicro-ipmi-firmware-vulnerabilitiesThird Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/89044Third Party Advisory, VDB Entry
• https://support.citrix.com/article/CTX216642Third Party Advisory
• https://www.supermicro.com/products/nfo/files/IPMI/CVE_Update.pdfVendor Advisory

Published

Jan 2, 2020

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-3612Dahua DVR appliances have a hardcoded password for (1) the r…
• CVE-2013-3613Dahua DVR appliances do not properly restrict UPnP requests,…
• CVE-2013-3614Dahua DVR appliances have a small value for the maximum pass…
• CVE-2013-3615Dahua DVR appliances use a password-hash algorithm with a sh…
• CVE-2013-3616Cross-site scripting (XSS) vulnerability in the KnowledgeVie…
• CVE-2013-3617The XML API in Openbravo ERP 2.5, 3.0, and earlier allows re…
• CVE-2013-3620Hardcoded WSMan credentials in Intelligent Platform Manageme…7.5
• CVE-2013-3621Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2013-3622Buffer overflow in logout.cgi in the Intelligent Platform Ma…
• CVE-2013-3623Multiple stack-based buffer overflows in cgi/close_window.cg…
• CVE-2013-3624The OS deployment feature in Baramundi Management Suite 7.5 …
• CVE-2013-3625An unspecified DLL file in Baramundi Management Suite 7.5 th…