Stack-Based Buffer Overflow in Supermicro BMC Firmware

CVE-2025-7623

What is CVE-2025-7623?

A stack-based buffer overflow vulnerability exists in the SMASH-CLP shell of Supermicro's BMC firmware. This flaw allows an authenticated attacker with SSH access to exploit a 260-byte stack buffer by delivering a specially crafted SMASH command. By manipulating the command, an attacker can overwrite critical return addresses and registers, leading to the execution of arbitrary code on the system's firmware operating environment.

References