CVE-2026-18451 - Vulnerability Details - OpenCVE

The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Smci	Mbd-x12spi

No data.

No data.

References

Link	Providers
https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1

History

Wed, 04 Nov 2026 15:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Wed, 28 Oct 2026 22:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Smci Smci mbd-x12spi
Vendors & Products		Smci Smci mbd-x12spi

Tue, 27 Oct 2026 08:00:00 +0000

Type	Values Removed	Values Added
Description		The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session.
Title		Supermicro BMC's iKVM feature is vulnerable to KVM session hijacking due to a predictable time-seeded launch token
Weaknesses		CWE-337
References		https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1
Metrics		cvssV3_1 `{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N'}`

MITRE

Status: PUBLISHED

Assigner: Supermicro

Published: 2026-10-27T07:51:10.336Z

Updated: 2026-11-04T14:59:34.154Z

Reserved: 2026-07-31T05:37:17.153Z

Link: CVE-2026-18451

Vulnrichment

Updated: 2026-11-04T14:51:09.199Z

NVD

Status : Awaiting Analysis

Published: 2026-10-27T08:16:53.827

Modified: 2026-11-04T15:17:44.417

Link: CVE-2026-18451

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-18451", "assignerOrgId": "def9a96e-e099-41a9-bfac-30fd4f82c411", "state": "PUBLISHED", "assignerShortName": "Supermicro", "dateReserved": "2026-07-31T05:37:17.153Z", "datePublished": "2026-10-27T07:51:10.336Z", "dateUpdated": "2026-11-04T14:59:34.154Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "def9a96e-e099-41a9-bfac-30fd4f82c411", "shortName": "Supermicro", "dateUpdated": "2026-10-27T07:51:10.336Z"}, "title": "Supermicro BMC's iKVM feature is vulnerable to KVM session hijacking due to a predictable time-seeded launch token", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-337", "description": "CWE-337: Predictable Seed in a Pseudo-Random Number Generator (PRNG)", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-59", "descriptions": [{"lang": "en", "value": "CAPEC-59: Session Hijacking"}]}], "affected": [{"vendor": "SMCI", "product": "MBD-X12SPI", "platforms": ["BMC"], "versions": [{"status": "affected", "version": "01.07.20", "versionType": "custom"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session."}]}], "references": [{"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "LOW", "baseScore": 3.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N"}}], "credits": [{"lang": "en", "value": "runZero", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-04T14:51:07.872155Z", "id": "CVE-2026-18451", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T14:59:34.154Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-18451", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-04T14:51:07.872155Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-04T14:51:09.199Z"}}], "cna": {"title": "Supermicro BMC's iKVM feature is vulnerable to KVM session hijacking due to a predictable time-seeded launch token", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "runZero"}], "impacts": [{"capecId": "CAPEC-59", "descriptions": [{"lang": "en", "value": "CAPEC-59: Session Hijacking"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SMCI", "product": "MBD-X12SPI", "versions": [{"status": "affected", "version": "01.07.20", "versionType": "custom"}], "platforms": ["BMC"], "defaultStatus": "affected"}], "references": [{"url": "https://www.supermicro.com/en/support/security_BMC_IPMI_Oct_2026_1"}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session.", "supportingMedia": [{"type": "text/html", "value": "The HTML5 KVM-over-IP console authenticates with a token returned by the web interface. Weaknesses in token generation may allow an attacker to guess the session token and take control of the KVM session.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-337", "description": "CWE-337: Predictable Seed in a Pseudo-Random Number Generator (PRNG)"}]}], "providerMetadata": {"orgId": "def9a96e-e099-41a9-bfac-30fd4f82c411", "shortName": "Supermicro", "dateUpdated": "2026-10-27T07:51:10.336Z"}}}, "cveMetadata": {"cveId": "CVE-2026-18451", "state": "PUBLISHED", "dateUpdated": "2026-11-04T14:59:34.154Z", "dateReserved": "2026-07-31T05:37:17.153Z", "assignerOrgId": "def9a96e-e099-41a9-bfac-30fd4f82c411", "datePublished": "2026-10-27T07:51:10.336Z", "assignerShortName": "Supermicro"}, "dataVersion": "5.2"}