CVE-2023-2992

published 2023-06-26

CVE-2023-2992: An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions…

Priority P3 40 high 7.5 CVSS 3.1

AV N AC L PR N UI N S U C N I N A H

An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions. Rebooting SMM or FPC will restore access to the management web server.

Affected

10 ranges

Vendor	Product	Version range	Fixed in
lenovo	fan_power_controller	—	—
lenovo	nextscale_n1200_enclosure_firmware	< fhet60b-3.40	fhet60b-3.40
lenovo	system_management_module	—	—
lenovo	thinkagile_cp-cb-10_firmware	< tesm38c-1.26	tesm38c-1.26
lenovo	thinkagile_cp-cb-10e_firmware	< tesm38c-1.26	tesm38c-1.26
lenovo	thinkagile_hx_enclosure_certified_node_firmware	< tesm38c-1.26	tesm38c-1.26
lenovo	thinkagile_vx_enclosure_firmware	< tesm38c-1.26	tesm38c-1.26
lenovo	thinksystem_d2_enclosure_firmware	< tesm38c-1.26	tesm38c-1.26
lenovo	thinksystem_da240_enclosure_firmware	< umsm10s-1.07	umsm10s-1.07
lenovo	thinksystem_dw612_enclosure_firmware	< umsm10s-1.07	umsm10s-1.07

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-405 CWE-400