CVE-2023-2993: Lenovo Nextscale n1200 Enclosure Firmware

Medium severity, CVSS 6.3. EPSS: 0.3% chance of exploitation in the next 30 days.

A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute.

Affected products

• Lenovo Nextscale n1200 Enclosure Firmware: before fhet60b-3.40 (fixed in fhet60b-3.40)
• Lenovo Thinkagile CP-Cb-10 Firmware: before tesm38c-1.26 (fixed in tesm38c-1.26)
• Lenovo Thinkagile CP-Cb-10e Firmware: before tesm38c-1.26 (fixed in tesm38c-1.26)
• Lenovo Thinkagile HX Enclosure Certified Node Firmware: before tesm38c-1.26 (fixed in tesm38c-1.26)
• Lenovo Thinkagile Vx Enclosure Firmware: before tesm38c-1.26 (fixed in tesm38c-1.26)
• Lenovo Thinksystem d2 Enclosure Firmware: before tesm38c-1.26 (fixed in tesm38c-1.26)
• Lenovo Thinksystem DA240 Enclosure Firmware: before umsm10s-1.07 (fixed in umsm10s-1.07)
• Lenovo Thinksystem DW612 Enclosure Firmware: before umsm10s-1.07 (fixed in umsm10s-1.07)

Published 2023-06-26. Last modified 2026-06-17.