Technical impact
The vulnerability is a command injection flaw in the SMTP service of the Supermicro BMC, specifically the AS‑2115HS‑TNR model. An attacker can supply specially crafted characters that are incorporated into the service configuration and subsequently executed by the underlying system. This flaw may enable denial‑of‑service, arbitrary command execution, or permanent compromise of the controller, representing a severe software flaw (CWE‑78).
Affected Systems
The affected system is the Supermicro Baseboard Management Controller (BMC) in the AS‑2115HS‑TNR model. No additional version details are supplied; the vulnerability is tied to the SMTP service component of that BMC firmware.
Risk and Exploitability
The CVSS score of 7.2 indicates high severity, but no EPSS value is available, making the exact likelihood of exploitation uncertain. The flaw is not listed in the CISA KEV catalog, suggesting no known public exploits at the time of this analysis. The likely attack vector involves an external network attacker sending malicious SMTP protocol traffic to the BMC to trigger the command injection.
