High severity · published Apr 22, 2019
CVE-2019-6157
In various firmware versions of Lenovo System x, the integrated management module II (IMM2)'s first failure data capture (FFDC) includes the web server's private key in the…
7.5
CVSS
1.3%
EPSS
No
On KEV
Description
In various firmware versions of Lenovo System x, the integrated management module II (IMM2)'s first failure data capture (FFDC) includes the web server's private key in the generated log file for support.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 71% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SX
System x · Lenovo
various · source: vendor
BH
Bladecenter Hs22 Firmware · Ibm
before 7.20 · source: NVD
BH
Bladecenter Hs23 Firmware · Ibm
before 7.20 · source: NVD
BH
Bladecenter Hs23e Firmware · Ibm
before 7.20 · source: NVD
FS
Flex System X220 M4 Firmware · Ibm
before 7.20 · source: NVD
FS
Flex System X222 M4 Firmware · Ibm
before 7.20 · source: NVD
FS
Flex System X240 M4 Firmware · Ibm
before 7.20 · source: NVD
FS
Flex System X240 M5 Firmware · Lenovo
before 5.30 · source: NVD
FS
Flex System X280 M4 Firmware · Ibm
before 7.20 · source: NVD
FS
Flex System X280 X6 Firmware · Lenovo
before 5.30 · source: NVD
FS
Flex System X440 M4 Firmware · Lenovo
before 5.30 · source: NVD
FS
Flex System X480 M4 Firmware · Ibm
before 7.20 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-6157
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-6157
Patch
https://support.lenovo.com/solutions/LEN-25667
More from System x
6.4
CVE-2020-8332
A potential vulnerability in the SMI callback function used in the legacy BIOS mode USB drivers in some legacy Lenovo and IBM System x servers may allow arbitrary code execution