CVE-2023-2992

An unauthenticated  denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions. Rebooting SMM or FPC will restore access to the management web server.

Score

CVSS 3.1 7.5 High

Status

Modified - psirt@lenovo.com

Published

2023-06-26

Last modified

2024-09-16

Weaknesses

CWE-405

Affected products

• Fan Power Controller Fpc (Lenovo)
• Nextscale N1200 Enclosure Firmware (Lenovo)
• System Management Module Smm (Lenovo)
• Thinkagile Cp-cb-10 Firmware (Lenovo)
• Thinkagile Cp-cb-10e Firmware (Lenovo)
• Thinkagile Hx Enclosure Certified Node Firmware (Lenovo)
• Thinkagile Hx Enclosure Firmware (Lenovo)
• Thinkagile Vx Enclosure Firmware (Lenovo)
• Thinksystem D2 Enclosure Firmware (Lenovo)
• Thinksystem Da240 Enclosure Firmware (Lenovo)
• Thinksystem Dw612 Enclosure Firmware (Lenovo)

References

• https://support.lenovo.com/us/en/product_security/LEN-127357