CVE-2018-16090: In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to post-authentication command injection.

high7.5CVSS 3.0

AVNACHPRLUINSUCHIHAH

In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to post-authentication command injection.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
lenovo	system_management_module_firmware	< 1.06	1.06
lenovo	thinksystem_smm	>= unspecified < 1.06	1.06