CVE-2023-2993
Medium
Description
A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute.
SeverityMedium
CVSS5.4
Exploit probability—
ProductLenovo Nextscale N1200 Enclosure Firmware
PublishedJun 26, 2023
First seenJun 26, 2023
Weakness typeCWE-281CWE-281
How to fix
Update
- lenovo nextscale_n1200_enclosure_firmwarefhet60b-3.40 or later
- lenovo thinkagile_cp-cb-10_firmwaretesm38c-1.26 or later
- lenovo thinkagile_cp-cb-10e_firmwaretesm38c-1.26 or later
- lenovo thinkagile_hx_enclosure_certified_node_firmwaretesm38c-1.26 or later
- lenovo thinkagile_vx_enclosure_firmwaretesm38c-1.26 or later
- lenovo thinksystem_d2_enclosure_firmwaretesm38c-1.26 or later
- lenovo thinksystem_da240_enclosure_firmwareumsm10s-1.07 or later
- lenovo thinksystem_dw612_enclosure_firmwareumsm10s-1.07 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lenovo nextscale_n1200_enclosure_firmware | v < fhet60b-3.40 | fhet60b-3.40 |
| lenovo thinkagile_cp-cb-10_firmware | v < tesm38c-1.26 | tesm38c-1.26 |
| lenovo thinkagile_cp-cb-10e_firmware | v < tesm38c-1.26 | tesm38c-1.26 |
| lenovo thinkagile_hx_enclosure_certified_node_firmware | v < tesm38c-1.26 | tesm38c-1.26 |
| lenovo thinkagile_vx_enclosure_firmware | v < tesm38c-1.26 | tesm38c-1.26 |
| lenovo thinksystem_d2_enclosure_firmware | v < tesm38c-1.26 | tesm38c-1.26 |
| lenovo thinksystem_da240_enclosure_firmware | v < umsm10s-1.07 | umsm10s-1.07 |
| lenovo thinksystem_dw612_enclosure_firmware | v < umsm10s-1.07 | umsm10s-1.07 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.