SM
Product
System Management Module Firmware
13
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 10Medium 3Low 0
Watch
Add System Management Module Firmware to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-4856 | 8.8 | Apr 15 | A format string vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute arbitrary commands on a specific API endpoint Affected: 1.24 before tesm40b-1.27 |
| CVE-2018-9083 | 8.1 | Nov 27 | In System Management Module (SMM) versions prior to 1.06, the SMM contains weak default root credentials which could be used to log in to the device OS -- if the attacker manages… Affected: before 1.06 |
| CVE-2018-16094 | 8.1 | Nov 27 | In System Management Module (SMM) versions prior to 1.06, an internal SMM function that retrieves configuration settings is prone to a buffer overflow Affected: before 1.06 |
| CVE-2018-16092 | 8.1 | Nov 27 | In System Management Module (SMM) versions prior to 1.06, the FFDC feature includes the collection of SMM system files containing sensitive information; notably, the SMM user… Affected: before 1.06 |
| CVE-2018-16091 | 8.1 | Nov 27 | In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to several buffer overflows Affected: before 1.06 |
| CVE-2023-4857 | 7.5 | Apr 15 | An authentication bypass vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute certain IPMI calls that could lead to exposure of… Affected: 1.24 before tesm40b-1.27 |
| CVE-2018-16090 | 7.5 | Nov 27 | In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to post-authentication command injection Affected: before 1.06 |
| CVE-2018-16089 | 7.5 | Nov 27 | In System Management Module (SMM) versions prior to 1.06, a field in the header of SMM firmware update images is insufficiently sanitized, allowing post-authentication command… Affected: before 1.06 |
| CVE-2024-2659 | 7.2 | Apr 15 | A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to execute system commands when performing a… Affected: 1.24 before tesm40b-1.27 |
| CVE-2023-4855 | 7.2 | Apr 15 | A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to execute unauthorized commands via IPMI Affected: 1.24 before tesm40b-1.27 |
| CVE-2018-9084 | 6.5 | Nov 27 | In System Management Module (SMM) versions prior to 1.06, if an attacker manages to log in to the device OS, the validation of software updates can be circumvented Affected: before 1.06 |
| CVE-2018-16096 | 6.1 | Nov 27 | In System Management Module (SMM) versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML tags, possibly opening… Affected: before 1.06 |
| CVE-2018-16095 | 5.9 | Nov 27 | In System Management Module (SMM) versions prior to 1.06, the SMM records hashed passwords to a debug log when user authentication fails Affected: before 1.06 |
Showing 13