CVE-2018-9073

Lenovo Chassis Management Module (CMM) prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow an attacker that has already compromised the server to decrypt these secrets.

Score

CVSS 3.0 5.9 Medium

Status

Modified - psirt@lenovo.com

Published

2018-11-16

Last modified

2024-08-05

Weaknesses

CWE-798

Affected products

• Chassis Management Module Cmm (Lenovo)
• Chassis Management Module Firmware (Lenovo)

References

• https://support.lenovo.com/us/en/solutions/LEN-23806