Lucene search

[email protected]CVE-2023-2992

HistoryJun 26, 2023 - 8:15 p.m.

CVE-2023-2992

2023-06-2620:15:09

CWE-400

[email protected]

web.nvd.nist.gov

cve-2023-2992

unauthenticated

denial of service

smm v1

smm v2

fpc management

web server

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.1%

JSON

An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions. Rebooting SMM or FPC will restore access to the management web server.

Affected configurations

NVD

Node

lenovonextscale_n1200_enclosure_firmwareRange<fhet60b-3.40

AND

lenovonextscale_n1200_enclosureMatch-

Node

lenovothinkagile_cp-cb-10_firmwareRange<tesm38c-1.26

AND

lenovothinkagile_cp-cb-10Match-

Node

lenovothinkagile_cp-cb-10e_firmwareRange<tesm38c-1.26

AND

lenovothinkagile_cp-cb-10eMatch-

Node

lenovothinkagile_hx_enclosure_certified_node_firmwareRange<tesm38c-1.26

AND

lenovothinkagile_hx_enclosure_certified_nodeMatch-

Node

lenovothinkagile_vx_enclosure_firmwareRange<tesm38c-1.26

AND

lenovothinkagile_vx_enclosureMatch-

Node

lenovothinksystem_d2_enclosure_firmwareRange<tesm38c-1.26

AND

lenovothinksystem_d2_enclosureMatch-

Node

lenovothinksystem_da240_enclosure_firmwareRange<umsm10s-1.07

AND

lenovothinksystem_da240_enclosureMatch-

Node

lenovothinksystem_dw612_enclosure_firmwareRange<umsm10s-1.07

AND

lenovothinksystem_dw612_enclosureMatch-

CPENameOperatorVersion
lenovo:nextscale_n1200_enclosure_firmwarelenovo nextscale n1200 enclosure firmwareltfhet60b-3.40

CPE	Name	Operator	Version
lenovo:nextscale_n1200_enclosure_firmware	lenovo nextscale n1200 enclosure firmware	lt	fhet60b-3.40

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "System Management Module (SMM) ",
    "vendor": "Lenovo",
    "versions": [
      {
        "status": "affected",
        "version": "various"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "Fan Power Controller (FPC)",
    "vendor": "Lenovo",
    "versions": [
      {
        "status": "affected",
        "version": "various"
      }
    ]
  }
]

References

support.lenovo.com/us/en/product_security/LEN-127357

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

7.5 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.1%

JSON

Related for CVE-2023-2992

cvelist1 nvd1 prion1