CVE-2025-12007 Supermicro BMC firmware update validation bypass
An attacker can bypass firmware validation to install malicious firmware on Supermicro BMCs, leading to full system compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-12007?
CVE-2025-12007 is a high-severity vulnerability in SMCI X13SEM-F, published on 16 Jan 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X13SEM-F . An attacker can update the system firmware with a specially crafted image.
Weakness: CWE-347
Which versions are affected by CVE-2025-12007?
How do I fix CVE-2025-12007?
No fix has been published for CVE-2025-12007 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-12007 being exploited?
There is no known exploitation of CVE-2025-12007 in the wild and no public exploit code.
Sources
Also known as GHSA-cg7q-j82r-xv2m.