High severity · published Jun 26, 2023
CVE-2023-2992
An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions
7.5
CVSS
0.6%
EPSS
No
On KEV
Description
An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions. Rebooting SMM or FPC will restore access to the management web server.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
FP
Fan Power Controller (FPC) · Lenovo
various · source: vendor
SM
System Management Module (SMM) · Lenovo
various · source: vendor
NN
Nextscale N1200 Enclosure Firmware · Lenovo
before fhet60b-3.40 · source: NVD, CISA
TC
Thinkagile Cp-cb-10 Firmware · Lenovo
before tesm38c-1.26 · source: NVD, CISA
TC
Thinkagile Cp-cb-10e Firmware · Lenovo
before tesm38c-1.26 · source: NVD, CISA
TH
Thinkagile HX Enclosure Certified Node Firmware · Lenovo
before tesm38c-1.26 · source: NVD
TV
Thinkagile VX Enclosure Firmware · Lenovo
before tesm38c-1.26 · source: NVD, CISA
TD
Thinksystem D2 Enclosure Firmware · Lenovo
before tesm38c-1.26 · source: NVD, CISA
TD
Thinksystem Da240 Enclosure Firmware · Lenovo
before umsm10s-1.07 · source: NVD, CISA
TD
Thinksystem Dw612 Enclosure Firmware · Lenovo
before umsm10s-1.07 · source: NVD, CISA
TH
Thinkagile HX Enclosure Firmware · Lenovo
before tesm38c-1.2 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-2992
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-2992
Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-127357
More from Fan Power Controller (FPC)
6.3
CVE-2023-2993
A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM…