CVE-2026-18449

{
  "etk_id": "ETK-2026-2739",
  "cve_id": "CVE-2026-18449",
  "display_id": "CVE-2026-18449",
  "ghsa_id": "GHSA-h8gp-mmvv-4j3c",
  "euvd_id": "EUVD-2026-110623",
  "status": "in_pipeline",
  "anchor_state": "anchored",
  "title": "IPMI command integrity bypass in SMCI X12SPI",
  "summary": "SMCI X12SPI BMC systems are affected by insufficient enforcement of integrity and encryption requirements for IPMI commands. An attacker may be able to send crafted packets that execute commands in an active IPMI session; the evidence does not establish additional access prerequisites.",
  "mitigation": "Restrict IPMI/BMC network access to trusted administrative networks and disable or limit remote IPMI where it is not required. No fixed X12SPI version is recorded in the available advisory evidence.",
  "vendor": "SMCI",
  "product": "X12SPI",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "01.07.20"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "X12SPI",
      "purl": null
    }
  ],
  "cwes": [
    798
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 35.424689683333334,
  "t0_at": "2026-10-27T07:32:36.594000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-27T07:32:36.594000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-27T07:32:36.594000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18449"
    }
  }
}