CVE-2023-4856: Lenovo Fan Power Controller

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

A format string vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute arbitrary commands on a specific API endpoint.

Affected products

• Lenovo Fan Power Controller
• Lenovo Smm, SMM2, Fpc
• Lenovo System Management Module Firmware

Published 2024-04-15. Last modified 2026-06-17.