CVE-2023-2992: Lenovo Nextscale n1200 Enclosure Firmware

High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days.

An unauthenticated  denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions. Rebooting SMM or FPC will restore access to the management web server.

Affected products

• Lenovo Nextscale n1200 Enclosure Firmware: before fhet60b-3.40 (fixed in fhet60b-3.40)
• Lenovo Thinkagile CP-Cb-10 Firmware: before tesm38c-1.26 (fixed in tesm38c-1.26)
• Lenovo Thinkagile CP-Cb-10e Firmware: before tesm38c-1.26 (fixed in tesm38c-1.26)
• Lenovo Thinkagile HX Enclosure Certified Node Firmware: before tesm38c-1.26 (fixed in tesm38c-1.26)
• Lenovo Thinkagile Vx Enclosure Firmware: before tesm38c-1.26 (fixed in tesm38c-1.26)
• Lenovo Thinksystem d2 Enclosure Firmware: before tesm38c-1.26 (fixed in tesm38c-1.26)
• Lenovo Thinksystem DA240 Enclosure Firmware: before umsm10s-1.07 (fixed in umsm10s-1.07)
• Lenovo Thinksystem DW612 Enclosure Firmware: before umsm10s-1.07 (fixed in umsm10s-1.07)

Published 2023-06-26. Last modified 2026-06-17.