CVE-2018-13787
UnknownEPSS 0.42%
Last modified
CVE-2018-13787 is a vulnerability of currently unknown severity. Certain Supermicro X11S, X10, X9, X8SI, K1SP, C9X299, C7, B1, A2, and A1 products have a misconfigured Descriptor Region, allowing OS programs to modify firmware.. EPSS estimates a 0.42% chance of exploitation in the next 30 days.
Description
Certain Supermicro X11S, X10, X9, X8SI, K1SP, C9X299, C7, B1, A2, and A1 products have a misconfigured Descriptor Region, allowing OS programs to modify firmware.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Supermicro | X11ssz Firmware | All versions |
| Supermicro | X11ssv Firmware | All versions |
| Supermicro | X11ssql Firmware | All versions |
| Supermicro | X11ssq Firmware | All versions |
| Supermicro | X11ssn Firmware | All versions |
| Supermicro | X11srm Firmware | All versions |
| Supermicro | X11sra Firmware | All versions |
| Supermicro | X11sba Firmware | All versions |
| Supermicro | X11sat Firmware | All versions |
| Supermicro | X11sae M Firmware | All versions |
| Supermicro | X11sae Firmware | All versions |
| Supermicro | X10srw Firmware | All versions |
| Supermicro | X10srm Firmware | All versions |
| Supermicro | X10srl Firmware | All versions |
| Supermicro | X10sri Firmware | All versions |
| Supermicro | X10srh Firmware | All versions |
| Supermicro | X10srg Firmware | All versions |
| Supermicro | X10srd Firmware | All versions |
| Supermicro | X10sra Firmware | All versions |
| Supermicro | X10sdvt Firmware | All versions |
| Supermicro | X10sdvf Firmware | All versions |
| Supermicro | X10sde Firmware | All versions |
| Supermicro | X10sddf Firmware | All versions |
| Supermicro | X10sba Firmware | All versions |
| Supermicro | X10qrh Firmware | All versions |
| Supermicro | X10dsn Firmware | All versions |
| Supermicro | X10dscp Firmware | All versions |
| Supermicro | X10dsc Firmware | All versions |
| Supermicro | X10drx Firmware | All versions |
| Supermicro | X10drwn Firmware | All versions |
| Supermicro | X10drw Firmware | All versions |
| Supermicro | X10drux Firmware | All versions |
| Supermicro | X10drul Firmware | All versions |
| Supermicro | X10dru Firmware | All versions |
| Supermicro | X10drts Firmware | All versions |
| Supermicro | X10drtps Firmware | All versions |
| Supermicro | X10drtl Firmware | All versions |
| Supermicro | X10drth Firmware | All versions |
| Supermicro | X10drtb Firmware | All versions |
| Supermicro | X10drt Firmware | All versions |
| Supermicro | X10drs Firmware | All versions |
| Supermicro | X10drln Firmware | All versions |
| Supermicro | X10drlc Firmware | All versions |
| Supermicro | X10drl Firmware | All versions |
| Supermicro | X10dri1 Firmware | All versions |
| Supermicro | X10drh4 Firmware | All versions |
| Supermicro | X10drh Firmware | All versions |
| Supermicro | X10drgo Firmware | All versions |
| Supermicro | X10drgh Firmware | All versions |
| Supermicro | X10drg Firmware | All versions |
Showing 50 of 110 affected configurations. See NVD for the full list.
References
- https://www.supermicro.com/support/security_Intel-SA-00088.cfm?pg=X10#tabThird Party Advisory
- https://www.supermicro.com/support/security_Intel-SA-00088.cfm?pg=X10#tabThird Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2018-13787?
Certain Supermicro X11S, X10, X9, X8SI, K1SP, C9X299, C7, B1, A2, and A1 products have a misconfigured Descriptor Region, allowing OS programs to modify firmware.
How severe is CVE-2018-13787?
Severity scoring for CVE-2018-13787 is pending analysis. The EPSS model estimates a 0.42% probability of exploitation in the next 30 days.
How do I fix CVE-2018-13787?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2018
- CVE-2018-13780The mintToken function of a smart contract implementation fo…
- CVE-2018-13781The mintToken function of a smart contract implementation fo…7.5
- CVE-2018-13782The mintToken function of a smart contract implementation fo…
- CVE-2018-13783The mintToken function of a smart contract implementation fo…
- CVE-2018-13784PrestaShop before 1.6.1.20 and 1.7.x before 1.7.3.4 mishandl…
- CVE-2018-13785In libpng 1.6.34, a wrong calculation of row_factor in the p…6.5
- CVE-2018-13789An issue was discovered in Descor Infocad FM before 3.1.0.0.…
- CVE-2018-13790A Server Side Request Forgery (SSRF) vulnerability in tools/…7.2
- CVE-2018-13791The HTTP API in ABBYY FlexiCapture before 12 Release 1 Updat…
- CVE-2018-13792Multiple SQL injection vulnerabilities in the monitoring fea…9.8
- CVE-2018-13793Multiple Cross Site Request Forgery (CSRF) vulnerabilities i…
- CVE-2018-13794A heap-based buffer overflow exists in stbi__bmp_load_cont i…9.8
Are you affected by CVE-2018-13787?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST