CVE-2018-9086

In some Lenovo ThinkServer-branded servers, a command injection vulnerability exists in the BMC firmware download command. This allows a privileged user to download and execute arbitrary code inside the BMC. This can only be exploited by authorized privileged users.

Score

CVSS 3.0 7.2 High

Status

Modified - psirt@lenovo.com

Published

2018-11-16

Last modified

2024-08-05

Weaknesses

CWE-78

Affected products

• Thinkserver Bmc (Lenovo)
• Thinkserver Rd340 Firmware (Lenovo)
• Thinkserver Rd440 Firmware (Lenovo)
• Thinkserver Rd640 Firmware (Lenovo)
• Thinkserver Td340 Firmware (Lenovo)

References

• https://support.lenovo.com/us/en/solutions/LEN-23836