The web interface in the Intelligent Platform Management Interface (IPMI) implementation on Supermicro H8DC* H8DG* H8SCM-F H8SGL-F H8SM* X7SP* X8DT* X8SI* X9DAX-* X9DB* X9DR* X9QR* X9SBAA-F X9SC* X9SPU-F and X9SR* devices allows remote authenticated users to execute arbitrary commands via shell metacharacters as demonstrated by the IP address field in config_date_time.cgi.