CVE-2025-6198

—

CVSS 3.1

7.2 high

EPSS

<1%p24

Published

Sep 19, 2025 (Sep 19, 2025)

Modified

Jun 17, 2026

Description

There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X13SEM-F . An attacker can update the system firmware with a specially crafted image.

Weakness: CWE-347
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.3%)

In the news3 stories

⚡ Weekly Recap: Cisco 0-Day, Record DDoS, LockBit 5.0, BMC Bugs, ShadowV2 Botnet & More

The Hacker NewsOct 6, 11:28 UTC · Oct 6, 2025Ransomware CVE-2025-20362 CVE-2025-20333 CVE-2025-20363+15 CVEs

Supermicro server motherboards can be infected with unremovable malware

Ars Technica · SecuritySep 24, 11:15 UTC · Sep 24, 2025Malware CVE-2024-10237 CVE-2025-7937 CVE-2025-6198

Two New Supermicro BMC Bugs Allow Malicious Firmware to Evade Root of Trust Security

The Hacker NewsSep 23, 18:00 UTC · Sep 23, 2025Vulnerability CVE-2025-7937 CVE-2025-6198 CVE-2024-10237+2 CVEs