CVE-2026-3820: Supermicro BMC's SMTP service contains a command injection vulnerability

Synopsis

A command injection vulnerability affects the SMTP service in the Supermicro BMC (Baseboard Management Controller) on the AS-2115HS-TNR platform. An attacker with administrator-level credentials can reach the service over the network and inject specially crafted characters into the SMTP configuration, causing the BMC to execute unintended OS commands during process invocation. Successful exploitation enables full compromise of the controller, arbitrary code execution, and denial of service. No upstream fix has been published yet; HarborGuard tracks this advisory and will surface a patched-image rebuild the moment Supermicro releases a remediated firmware version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The BMC SMTP service is exposed over the network, so the attacker must be able to reach the management interface remotely.

• AuthenticationRequired

  Administrator-level credentials are required; the attacker must already hold or obtain a privileged account on the BMC before injecting commands.

• Victim interactionNot required

  No user interaction is needed; the attacker operates entirely against the service configuration interface without involving another person.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is straightforward and does not depend on race conditions, specific memory layouts, or other unpredictable environmental factors.

Blast Radius

• The attacker executes arbitrary OS commands on the BMC, gaining full control over the controller and all management functions it exposes.
• Confidential BMC configuration data, credentials, and out-of-band management secrets stored on the controller are read directly.
• Persistent modification of BMC firmware or configuration is possible, surviving host OS reboots and standard remediation steps.
• The BMC service can be crashed or rendered permanently unresponsive, eliminating out-of-band management access to the physical host.