MEDIUM🇵🇱 Wersja polska

CVE-2023-2993

CVSS 5.4v3.1pub. 2023-06-26upd. 2024-11-21

A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

  • Lenovo Nextscale N1200 Enclosure

    HW
    Lenovo
    all versions

  • Lenovo Nextscale N1200 Enclosure Firmware

    OS
    Lenovo
    < fhet60b-3.40

  • Lenovo Thinkagile Cp Cb 10

    HW
    Lenovo
    all versions

  • Lenovo Thinkagile Cp Cb 10e

    HW
    Lenovo
    all versions

  • Lenovo Thinkagile Cp Cb 10e Firmware

    OS
    Lenovo
    < tesm38c-1.26

  • Lenovo Thinkagile Cp Cb 10 Firmware

    OS
    Lenovo
    < tesm38c-1.26

  • Lenovo Thinkagile Hx Enclosure Certified Node

    HW
    Lenovo
    all versions

  • Lenovo Thinkagile Hx Enclosure Certified Node Firmware

    OS
    Lenovo
    < tesm38c-1.26

  • Lenovo Thinkagile Vx Enclosure

    HW
    Lenovo
    all versions

  • Lenovo Thinkagile Vx Enclosure Firmware

    OS
    Lenovo
    < tesm38c-1.26

  • Lenovo Thinksystem D2 Enclosure

    HW
    Lenovo
    all versions

  • Lenovo Thinksystem D2 Enclosure Firmware

    OS
    Lenovo
    < tesm38c-1.26

  • Lenovo Thinksystem Da240 Enclosure

    HW
    Lenovo
    all versions

  • Lenovo Thinksystem Da240 Enclosure Firmware

    OS
    Lenovo
    < umsm10s-1.07

  • Lenovo Thinksystem Dw612 Enclosure

    HW
    Lenovo
    all versions

  • Lenovo Thinksystem Dw612 Enclosure Firmware

    OS
    Lenovo
    < umsm10s-1.07
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
CWE
References

Related vulnerabilities

CVE-2021-3849CRITICAL9.8PL ✓same product

Auth Bypass w firmware Lenovo FPC2 i SMM — zdalne wykonanie poleceń

CVE-2021-3897CRITICAL9.8PL ✓same product

Auth Bypass w firmware Lenovo FPC2 i SMM — nieautoryzowane wykonanie poleceń

CVE-2024-2659HIGH7.2same product

A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user w...

CVE-2023-2992HIGH7.5same product

An unauthenticated  denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web serve...

CVE-2022-34884HIGH7.2same product

A buffer overflow exists in the Remote Presence subsystem which can potentially allow valid, authenticated use...