System Management Module Firmware (Lenovo) - vulnerabilities (CVEs)
13 CVEs, 0 in the last 30 days, 4 known versions, newest CVE from 2024-04-15. Vendor: Lenovo.
CVEs of System Management Module Firmware
- CVE-2024-2659 - CVSS 7.2 (high), 2024-04-15: A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to execute system…
- CVE-2023-4857 - CVSS 7.5 (high), 2024-04-15: An authentication bypass vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute certain IPMI calls that could lead…
- CVE-2023-4856 - CVSS 8.8 (high), 2024-04-15: A format string vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute arbitrary commands on a specific API…
- CVE-2023-4855 - CVSS 7.2 (high), 2024-04-15: A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to execute unauthorized…
- CVE-2018-16095 - CVSS 5.9 (medium), 2018-11-27: In System Management Module (SMM) versions prior to 1.06, the SMM records hashed passwords to a debug log when user authentication fails.
- CVE-2018-9084 - CVSS 6.5 (medium), 2018-11-27: In System Management Module (SMM) versions prior to 1.06, if an attacker manages to log in to the device OS, the validation of software updates can be…
- CVE-2018-16090 - CVSS 7.5 (high), 2018-11-27: In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to post-authentication command injection.
- CVE-2018-16094 - CVSS 8.1 (high), 2018-11-27: In System Management Module (SMM) versions prior to 1.06, an internal SMM function that retrieves configuration settings is prone to a buffer overflow.
- CVE-2018-9083 - CVSS 8.1 (high), 2018-11-27: In System Management Module (SMM) versions prior to 1.06, the SMM contains weak default root credentials which could be used to log in to the device OS -- if…
- CVE-2018-16089 - CVSS 7.5 (high), 2018-11-27: In System Management Module (SMM) versions prior to 1.06, a field in the header of SMM firmware update images is insufficiently sanitized, allowing…
- CVE-2018-16092 - CVSS 8.1 (high), 2018-11-27: In System Management Module (SMM) versions prior to 1.06, the FFDC feature includes the collection of SMM system files containing sensitive information;…
- CVE-2018-16096 - CVSS 6.1 (medium), 2018-11-27: In System Management Module (SMM) versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML…
- CVE-2018-16091 - CVSS 8.1 (high), 2018-11-27: In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to several buffer overflows.
