CVE-2018-16090: Improper Neutralization of Special Elements used in an OS Command

In System Management Module SMM versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to post-authentication command injection...

CVE-2018-16096: Improper Neutralization of Input During Web Page Generation

In System Management Module SMM versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML tags, possibly opening a path for cross-site scripting...

CVE-2018-16091: Improper Restriction of Operations within the Bounds of a Memory Buffer

In System Management Module SMM versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to several buffer overflows...

CVE-2018-16095: Insertion of Sensitive Information into Log File

In System Management Module SMM versions prior to 1.06, the SMM records hashed passwords to a debug log when user authentication fails...

PT-2018-13405

Name of the Vulnerable Software and Affected Versions System Management Module SMM versions prior to 1.06 Description The issue concerns the collection of sensitive information by the FFDC feature in the SMM. This feature collects SMM system files, which include SMM user account credentials and t...

PT-2018-13409

Name of the Vulnerable Software and Affected Versions System Management Module SMM versions prior to 1.06 Description The issue is related to the SMM web interface, specifically the part responsible for changing Enclosure VPD. It fails to properly sanitize input for HTML tags, which could lead to...

PT-2018-13404

Name of the Vulnerable Software and Affected Versions System Management Module SMM versions prior to 1.06 Description The issue affects the SMM certificate creation and parsing logic, making it susceptible to several buffer overflows. Recommendations For versions prior to 1.06, update to version...

PT-2018-18844

Name of the Vulnerable Software and Affected Versions System Management Module SMM versions prior to 1.06 Description The issue concerns weak default root credentials in the System Management Module SMM. These credentials could potentially be used to log in to the device OS if an attacker...

PT-2018-18845

Name of the Vulnerable Software and Affected Versions System Management Module SMM versions prior to 1.06 Description The issue allows an attacker who has gained access to the device OS to bypass the validation of software updates. Recommendations For versions prior to 1.06, update to version 1.0...

PT-2018-13403

Name of the Vulnerable Software and Affected Versions System Management Module SMM versions prior to 1.06 Description The issue concerns the SMM certificate creation and parsing logic, which is susceptible to post-authentication command injection. This means that after a user has authenticated, a...

CVE-2018-9084: Undefined Security Weakness

In System Management Module SMM versions prior to 1.06, if an attacker manages to log in to the device OS, the validation of software updates can be circumvented...

CVE-2018-16094: Improper Restriction of Operations within the Bounds of a Memory Buffer

In System Management Module SMM versions prior to 1.06, an internal SMM function that retrieves configuration settings is prone to a buffer overflow...