CVE-2018-9086 Legacy Server BMC Remote Command Injection

2018-11-1614:00:00

lenovo

www.cve.org

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

45.4%

JSON

In some Lenovo ThinkServer-branded servers, a command injection vulnerability exists in the BMC firmware download command. This allows a privileged user to download and execute arbitrary code inside the BMC. This can only be exploited by authorized privileged users.

CNA Affected

[
  {
    "product": "ThinkServer BMC",
    "vendor": "Lenovo",
    "versions": [
      {
        "lessThan": "varies",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

support.lenovo.com/us/en/solutions/LEN-23836