CVE-2026-18450

{
  "etk_id": "ETK-2026-2738",
  "cve_id": "CVE-2026-18450",
  "display_id": "CVE-2026-18450",
  "ghsa_id": "GHSA-4gmh-3v9m-9469",
  "euvd_id": "EUVD-2026-110633",
  "status": "published",
  "anchor_state": "anchored",
  "title": "IPMI command authentication flaw in SMCI X12SPI BMC",
  "summary": "SMCI X12SPI BMC firmware inadequately applies integrity and encryption protections to IPMI commands. A network attacker may be able to run commands by sending crafted traffic to an active IPMI session; an active session is a required condition.",
  "mitigation": "Restrict BMC/IPMI network access to trusted administrative hosts and disable IPMI access where it is not required. Monitor the vendor's security advisories and apply an updated BMC firmware release when one is provided.",
  "vendor": "SMCI",
  "product": "X12SPI",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "01.07.20"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "X12SPI",
      "purl": null
    }
  ],
  "cwes": [
    306
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 14.055862283333333,
  "t0_at": "2026-10-27T07:46:02.598000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-27T07:46:02.598000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-27T07:46:02.598000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-18450"
    }
  }
}