CVE-2026-3820 HIGH

CVE-2026-3820: Supermicro BMC's SMTP service contains a command injection vulnerability

Vendor Smci
Product AS-2115HS-TNR
Weakness CWE-78
Published June 4, 2026
Last update June 5, 2026

CVSS base score

7.2/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

There is a vulnerability in the Supermicro BMC SMTP service at Supermicro AS-2115HS-TNR.  An attacker may obtain administrator privileges and inject specially crafted characters into the SMTP service configuration. This may cause the underlying system to execute unintended commands during process invocation. Potential impact includes denial-of-service attacks, arbitrary code execution, or permanent compromise of the controller.

Key dates

02Disclosure timeline

June 4, 2026 CVE published
June 5, 2026 Record updated