CVE-2018-9071: Lenovo Chassis Management Module Firmware

Medium severity, CVSS 5.3. EPSS: 1% chance of exploitation in the next 30 days.

Lenovo Chassis Management Module (CMM) prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current authentication configuration settings. Exposed settings relate to password lengths, expiration, and lockout configuration.

Affected products

• Lenovo Chassis Management Module Firmware: before 2.0.0 (fixed in 2.0.0)

Published 2018-11-16. Last modified 2026-06-17.