An attacker can exploit a weakness in the KVM-over-IP feature of Supermicro BMCs. The console authenticates with a launch token that is generated by the device's web interface. The token generator uses a time‑based seed that is easily predicted, allowing an attacker to guess a valid token. Success in guessing the token gives the attacker control over the virtual KVM session, effectively enabling remote console access to the host that may lead to full system compromise. This flaw corresponds to the CWE-337 category, illustrating the dangers of predictable random values.

Affected hardware includes Supermicro BMCs, specifically the SMCI:MBD-X12SPI board. Current information does not specify a limited range of firmware or model versions, so any deployment of this BMC product can be considered at risk until an update is applied.

The CVSS score of 3.1 indicates a low overall severity, and no EPSS value is supplied. Nonetheless, if an attacker can reach the BMC web interface—typically through the management network—he/she may guess the token and hijack the session. Because the vulnerability is tied to the token generation algorithm, the main challenge for exploitation is predicting the time‑based seed. While the score is low, the potential impact of gaining KVM console access warrants careful review, especially in environments where BMC access is not suitably restricted.