PT-2024-3582 · Lenovo · Lenovo Cp-Cb-10+3

Published 2024-04-09 · Updated 2024-04-15 · CVE-2023-4857

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Lenovo ThinkSystem, ThinkAgile, NeXtScale, and Lenovo CP-CB-10 (affected versions not specified)

Description The issue is related to an authentication bypass vulnerability in the System Management Module (SMM/SMM2) and Fan Power Controller (FPC) firmware of Lenovo systems. This vulnerability could allow an authenticated user to execute certain IPMI calls, potentially leading to the exposure of limited system information. The vulnerability is associated with the lack of authentication for a critical function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BDU:2024-03887

CVE-2023-4857

Affected Products

Lenovo Cp-Cb-10

Lenovo Thinksystem

Nextscale

Thinkagile

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-4857 · Security Note
• https://bdu.fstec.ru/vul/2024-03887 · Security Note
• https://t.me/cvenotify/76855 · Telegram Post
• https://vuldb.com/ru/?id.260808 · Note
• https://support.lenovo.com/us/en/product_security/LEN-140420 · Note
• https://twitter.com/VulmonFeeds/status/1779974766595645928 · Twitter Post
• https://t.me/cvenotify/76833 · Telegram Post
• https://twitter.com/CVEnew/status/1779937545159147551 · Twitter Post