Cyber Posture

CVE-2025-12006

High

Published: 16 January 2026

Published
16 January 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0001 2.7th percentile
Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-12006 is a high-severity Improper Verification of Cryptographic Signature (CWE-347) vulnerability in Supermicro BMC (inferred from references). Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique System Firmware (T1542.001); ranked at the 2.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Threat & Defense at a Glance

What attackers do: exploitation maps to System Firmware (T1542.001).
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-347

Requires verification of digital signatures using organization-approved certificates before installation, directly preventing improper verification of cryptographic signatures.

addresses: CWE-347

Component authenticity commonly depends on cryptographic signatures; the control enforces proper verification of those signatures.

addresses: CWE-347

PKI certificates under an approved policy require cryptographic signature verification on issuance and validation.

addresses: CWE-347

Requires cryptographic signatures on authoritative data and support for verifying the chain of trust.

addresses: CWE-347

Mandates verification of cryptographic signatures (e.g., DNSSEC RRSIG) on resolution responses, addressing missing or bypassed signature checks.

addresses: CWE-347

Integrity tools commonly rely on cryptographic signatures whose improper validation this weakness covers.

addresses: CWE-347

Authenticity validation commonly relies on cryptographic signature or certificate checks that this control enforces.

MITRE ATT&CK Enterprise TechniquesAI

T1542.001 System Firmware Stealth
Adversaries may modify system firmware to persist on systems.
Why these techniques?

CVE directly bypasses firmware signature validation (CWE-347) to permit arbitrary system firmware images, enabling T1542.001 System Firmware for persistence.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X12STW-F . An attacker can update the system firmware with a specially crafted image.

Deeper analysisAI

CVE-2025-12006, published on 2026-01-16, is a vulnerability in the Supermicro BMC firmware validation logic on the Supermicro MBD-X12STW-F motherboard. It enables an attacker to update the system firmware using a specially crafted image. The issue carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-347.

The vulnerability can be exploited by an attacker with high privileges over the network, requiring low complexity and no user interaction. Successful exploitation allows high-impact compromise of confidentiality, integrity, and availability on the affected system, such as arbitrary firmware modification leading to persistent control.

Supermicro has published a security advisory with mitigation guidance at https://www.supermicro.com/en/support/security_BMC_IPMI_Jan_2026.

Details

CWE(s)

Affected Products

Supermicro
BMC
inferred from references and description; NVD did not file a CPE for this CVE

CVEs Like This One

CVE-2024-56161Shared CWE-347
CVE-2025-12007Shared CWE-347
CVE-2025-27773Shared CWE-347
CVE-2026-5466Shared CWE-347
CVE-2026-40372Shared CWE-347
CVE-2026-38651Shared CWE-347
CVE-2026-34377Shared CWE-347
CVE-2026-20997Shared CWE-347
CVE-2025-23206Shared CWE-347
CVE-2025-52648Shared CWE-347

References