CVE-2025-12007

CVE-2025-12007: Supermicro BMC firmware update validation bypass

Vendor Smci

Product X13SEM-F

Weakness CWE-347

Published January 16, 2026

Last update February 26, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

There is a vulnerability in the Supermicro BMC firmware validation logic at Supermicro MBD-X13SEM-F . An attacker can update the system firmware with a specially crafted image.

Key dates

02Disclosure timeline

January 16, 2026 CVE published

February 26, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-12007 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/347.html

Related vulnerabilities

04Related CVE

CVE-2022-1739 2.2.1 IMPROPER VERIFICATION OF CRYPTOGRAPHIC SIGNATURE CWE-347 CVE-2024-37886 Nextcloud user_oidc's ID4me does not validate signature or expiration CVE-2024-9487 An Improper Verification of Cryptographic Signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed when the encrypted assertions feature was enabled CVE-2024-7788 Signatures in "repair mode" should not be trusted CVE-2026-6911 Authentication Bypass via Missing JWT Signature Verification in AWS Ops Wheel