CVE-2025-7623

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-7623
Stack-based buffer overflow in the SMASH-CLP shell. An authenticated attacker with SSH access to the BMC can exploit a stack buffer overflow via a crafted SMASH command, overwrite the return address and registers, and achieve arbitrary code execution on the BMC firmware operating system

5.4 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://www.supermicro.com/zh_tw/support/security_BMC_IPMI_Nov_2025
Configurations

No configuration.

History

18 Nov 2025, 08:15

Type Values Removed Values Added
Summary (en) Stack-based buffer overflow in the SMASH-CLP shell. An authenticated attacker with SSH access to the BMC can overflow a 260-byte stack buffer via a crafted SMASH command, overwrite the return address and registers, and achieve arbitrary code execution on the BMC’s firmware operating system. (en) Stack-based buffer overflow in the SMASH-CLP shell. An authenticated attacker with SSH access to the BMC can exploit a stack buffer overflow via a crafted SMASH command, overwrite the return address and registers, and achieve arbitrary code execution on the BMC firmware operating system

18 Nov 2025, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-11-18 07:15

Updated : 2025-11-18 14:06

NVD link : CVE-2025-7623

Mitre link : CVE-2025-7623

CVE.ORG link : CVE-2025-7623

JSON object : View

Products Affected

No product.

CWE
CWE-121

Stack-based Buffer Overflow