CVE-2018-16096: Lenovo System Management Module Firmware

Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days.

In System Management Module (SMM) versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML tags, possibly opening a path for cross-site scripting.

Affected products

• Lenovo System Management Module Firmware: before 1.06 (fixed in 1.06)

Published 2018-11-27. Last modified 2026-06-17.