CVE-2026-3820 PUBLISHED

Supermicro BMC's SMTP service contains a command injection vulnerability

Assigner: Supermicro
Reserved: 09.03.2026 Published: 04.06.2026 Updated: 04.06.2026

There is a vulnerability in the Supermicro BMC SMTP service at Supermicro AS-2115HS-TNR.  An attacker may obtain administrator privileges and inject specially crafted characters into the SMTP service configuration. This may cause the underlying system to execute unintended commands during process invocation.

Potential impact includes denial-of-service attacks, arbitrary code execution, or permanent compromise of the controller.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS Score: 7.2

Product Status

Vendor SMCI
Product AS-2115HS-TNR
Versions Default: affected
  • Version 01.08.01 is affected
  • Version 01.06.04 is affected

Credits

  • Coreweave Red Team and Hoang Bui from Coreweave finder

References

Problem Types

  • CWE-78 Improper neutralization of special elements used in an OS command ('OS command injection') CWE

Impacts

  • CAPEC-88 OS Command Injection