Vulnerability record · CVE-2013-3623 · published 10 December 2013
CVE-2013-3623: Supermicro IPMI web interface stack buffer overflow via close_window.cgi
Supermicro · Intelligent Platform Management Firmware
The cgi/close_window.cgi script in the Supermicro IPMI web interface (firmware before 3.15, SMT_X9_315) on X9 generation motherboards contains multiple stack-based buffer overflows in the sess_sid and ACT parameters. A remote, unauthenticated attacker can trigger the overflow and execute arbitrary code on the management controller, which sits outside the host OS and typically has privileged access to the server.
Description
Multiple stack-based buffer overflows in cgi/close_window.cgi in the web interface in the Intelligent Platform Management Interface (IPMI) with firmware before 3.15 (SMT_X9_315) on Supermicro X9 generation motherboards allow remote attackers to execute arbitrary code via the (1) sess_sid or (2) ACT parameter.
AV:N/AC:L/Au:N/C:C/I:C/A:C
Automated analysis
critical priorityCVSS 2.0 base score of 10 with network reachability, no authentication, and public exploit code makes this a high-risk, easily weaponized flaw.
What it is
The cgi/close_window.cgi script in the Supermicro IPMI web interface (firmware before 3.15, SMT_X9_315) on X9 generation motherboards contains multiple stack-based buffer overflows in the sess_sid and ACT parameters. A remote, unauthenticated attacker can trigger the overflow and execute arbitrary code on the management controller, which sits outside the host OS and typically has privileged access to the server.
Impact
Successful exploitation gives the attacker arbitrary code execution on the IPMI/BMC, allowing full control of the management interface and, from there, potential control over the managed host (power, console, virtual media).
Attack surface
Reachable over the network through the IPMI web interface HTTP endpoint cgi/close_window.cgi; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required.
Exploitation
Public exploit code exists (ExploitDB 29666 and a Metasploit-related Rapid7 post), and EPSS is 0.72375 (99.4th percentile), though the CVE is not listed in CISA KEV.
What to do
- Upgrade Supermicro IPMI firmware to 3.15 (SMT_X9_315) or later per the vendor advisory.
- If patching is not immediately possible, isolate BMC/IPMI interfaces on a dedicated management VLAN and block access from untrusted networks.
- Disable or restrict the IPMI web interface where it is not required, and change default BMC credentials.
- Monitor vendor and Citrix advisories for any additional guidance affecting the same firmware line.
Detection
- Inspect HTTP requests to cgi/close_window.cgi for oversized or malformed sess_sid or ACT parameters.
- Alert on crash or restart events of the BMC web service, which may indicate a failed overflow attempt.
- Hunt for exploit traffic matching public PoC signatures for CVE-2013-3623 against management interfaces.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2013-3623 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2013-3623), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
