Lenovo System Management Module Firmware vulnerabilities

12 CVEs affecting Lenovo System Management Module Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-4857, published 2024-04-15.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-16089, published 2018-11-27. High severity, CVSS 7.5. EPSS: 1.7% chance of exploitation in the next 30 days. In System Management Module (SMM) versions prior to 1.06, a field in the header of SMM firmware update images is insufficiently sanitized, allowing post-authentication command injection on the SMM as…
CVE-2023-4855, published 2024-04-15. High severity, CVSS 7.2. EPSS: 1.1% chance of exploitation in the next 30 days. A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to execute unauthorized commands via IPMI.
CVE-2018-9083, published 2018-11-27. High severity, CVSS 8.1. EPSS: 1.1% chance of exploitation in the next 30 days. In System Management Module (SMM) versions prior to 1.06, the SMM contains weak default root credentials which could be used to log in to the device OS -- if the attacker manages to enable SSH or…
CVE-2018-16095, published 2018-11-27. Medium severity, CVSS 5.9. EPSS: 0.9% chance of exploitation in the next 30 days. In System Management Module (SMM) versions prior to 1.06, the SMM records hashed passwords to a debug log when user authentication fails.
CVE-2018-16094, published 2018-11-27. High severity, CVSS 8.1. EPSS: 0.9% chance of exploitation in the next 30 days. In System Management Module (SMM) versions prior to 1.06, an internal SMM function that retrieves configuration settings is prone to a buffer overflow.
CVE-2018-16090, published 2018-11-27. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to post-authentication command injection.
CVE-2018-16092, published 2018-11-27. High severity, CVSS 8.1. EPSS: 0.9% chance of exploitation in the next 30 days. In System Management Module (SMM) versions prior to 1.06, the FFDC feature includes the collection of SMM system files containing sensitive information; notably, the SMM user account credentials and…
CVE-2018-9084, published 2018-11-27. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. In System Management Module (SMM) versions prior to 1.06, if an attacker manages to log in to the device OS, the validation of software updates can be circumvented.
CVE-2023-4856, published 2024-04-15. High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days. A format string vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute arbitrary commands on a specific API endpoint.
CVE-2018-16096, published 2018-11-27. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. In System Management Module (SMM) versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML tags, possibly opening a path for…

Latest

CVE-2023-4857, published 2024-04-15. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. An authentication bypass vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute certain IPMI calls that could lead to exposure of limited system…
CVE-2018-16091, published 2018-11-27. High severity, CVSS 8.1. EPSS: 0.6% chance of exploitation in the next 30 days. In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to several buffer overflows.