High severity · published Jun 26, 2023
CVE-2023-2992
An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions. Rebooting SMM or FPC will restore access to the management web server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NN
Nextscale N1200 Enclosure Firmware · Lenovo
before fhet60b-3.40 · source: NVD
TC
Thinkagile Cp-cb-10 Firmware · Lenovo
before tesm38c-1.26 · source: NVD
TC
Thinkagile Cp-cb-10e Firmware · Lenovo
before tesm38c-1.26 · source: NVD
TH
Thinkagile HX Enclosure Certified Node Firmware · Lenovo
before tesm38c-1.26 · source: NVD
TV
Thinkagile VX Enclosure Firmware · Lenovo
before tesm38c-1.26 · source: NVD
TD
Thinksystem D2 Enclosure Firmware · Lenovo
before tesm38c-1.26 · source: NVD
TD
Thinksystem Da240 Enclosure Firmware · Lenovo
before umsm10s-1.07 · source: NVD
TD
Thinksystem Dw612 Enclosure Firmware · Lenovo
before umsm10s-1.07 · source: NVD
Affected product
NN
Nextscale N1200 Enclosure Firmware
Lenovo
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-2992
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-2992
Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-127357
More from Nextscale N1200 Enclosure Firmware
9.8
CVE-2021-3897
An authentication bypass vulnerability was discovered in an internal service of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware during…
9.8
CVE-2021-3849
An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware that could…
7.2
CVE-2024-2659
A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to execute system commands when performing a…
6.3
CVE-2023-2993
A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM…