---
cve: "CVE-2024-36435"
severity: "CRITICAL"
cvss: 9.8
epss: "1.3%"
vendor: "n/a"
kev: false
exploited: false
published: "2024-07-11 21:15:12"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-11-09T12:07:35+01:00"
---

# CVE-2024-36435

> 9.8 CRITICAL

## Beschreibung

An issue was discovered on Supermicro BMC firmware in select X11, X12, H12, B12, X13, H13, and B13 motherboards (and CMM6 modules). An unauthenticated user can post crafted data to the interface that triggers a stack buffer overflow, and may lead to arbitrary remote code execution on a BMC.

## CNA-Record (Kanon, cvelistV5)

- CNA: **mitre**
- State: PUBLISHED
- Stand: 2024-08-02 03:37:05
- CNA-CVSS: **9.8** (`CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:N/S:U/UI:N
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-121** — Stack-based Buffer Overflow
  The product writes past the end of a buffer that was allocated on the stack.

## Referenzen

- <https://www.supermicro.com/zh_tw/support/security_BMC_IPMI_Jul_2024>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2024-36435/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_