Lenovo Security Advisory: LEN-20227
Potential Impact: Information disclosure
Severity: Medium
Scope of Impact: Lenovo-specific
CVE Identifier: CVE-2018-9068
Summary Description:
The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is made available for download through an SFTP server hosted on the IMM2 management network interface. The credentials to access the SFTP server are hard-coded and described in the IMM2 documentation, allowing an attacker with management network access to obtain the collected FFDC data.
Mitigation Strategy for Customers (what you should do to protect yourself):
Update IMM2 firmware to the version (or newer) described for your model in the Product Impact section. After applying this update, the IMM2 will create random SFTP credentials for use with OneCLI.