CVE-2024-10237

High

Published: 04 February 2025

Published

04 February 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0002 4.1th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-10237 is a high-severity Insufficient Verification of Data Authenticity (CWE-345) vulnerability in Supermicro MBD-X12DPG-OA6 (inferred from references). Its CVSS base score is 7.2 (High).

Operationally, ranked at the 4.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 CM-14 (Signed Components) and SI-7 (Software, Firmware, and Information Integrity).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-7 Software, Firmware, and Information Integrity good match

prevent

Mandates integrity verification of firmware using digital signatures or cryptographic hashes, directly preventing installation of modified BMC firmware images that bypass signature checks.

CM-14 Signed Components good match

prevent

Requires digital signatures on software components including firmware prior to installation, countering the BMC firmware authentication design flaw.

SR-11 Component Authenticity good match

prevent

Enforces verification of firmware component authenticity prior to installation, mitigating the ability to bypass BMC inspection and signature processes.

NVD Description

There is a vulnerability in the BMC firmware image authentication design at Supermicro MBD-X12DPG-OA6 . An attacker can modify the firmware to bypass BMC inspection and bypass the signature verification process

Deeper analysisAI

CVE-2024-10237, published on 2025-02-04, is a vulnerability in the BMC firmware image authentication design of the Supermicro MBD-X12DPG-OA6 motherboard. It enables an attacker to modify the firmware image to bypass BMC inspection and the signature verification process. The issue maps to CWE-345 and CWE-347, with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

The vulnerability can be exploited over the network by an attacker with high privileges, such as privileged BMC access, requiring low complexity and no user interaction. Successful exploitation grants high impacts on confidentiality, integrity, and availability, allowing the attacker to install unauthorized firmware modifications and potentially achieve full BMC compromise.

Supermicro has issued a security advisory at https://www.supermicro.com/en/support/security_BMC_IPMI_Jan_2025 addressing this BMC/IPMI vulnerability.