CVE-2018-9068

The IMM2 First Failure Data Capture function collects management module logs and diagnostic information when a hardware error is detected. This information is made available for download through an SFTP server hosted on the IMM2 management network interface. In versions earlier than 4.90 for Lenovo System x and earlier than 6.80 for IBM System x, the credentials to access the SFTP server are hard-coded and described in the IMM2 documentation, allowing an attacker with management network access to obtain the collected FFDC data. After applying the update, the IMM2 will create random SFTP credentials for use with OneCLI.

• CWE-798

• https://support.lenovo.com/us/en/solutions/LEN-20227Vendor Advisory
• https://support.lenovo.com/us/en/solutions/LEN-20227Vendor Advisory

Published

Jul 26, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-9062In some Lenovo ThinkPad products, one BIOS region is not pro…6.8
• CVE-2018-9063MapDrv (C:\Program Files\Lenovo\System Update\mapdrv.exe) In…
• CVE-2018-9064In Lenovo xClarity Administrator versions earlier than 2.1.0…
• CVE-2018-9065In Lenovo xClarity Administrator versions earlier than 2.1.0…
• CVE-2018-9066In Lenovo xClarity Administrator versions earlier than 2.1.0…
• CVE-2018-9067The Lenovo Help Android app versions earlier than 6.1.2.0327…
• CVE-2018-9069In some Lenovo IdeaPad consumer notebook models, a race cond…5.9
• CVE-2018-9070For the Lenovo Smart Assistant Android app versions earlier …
• CVE-2018-9071Lenovo Chassis Management Module (CMM) prior to version 2.0.…
• CVE-2018-9072In versions prior to 5.5, LXCI for VMware allows an authenti…
• CVE-2018-9073Lenovo Chassis Management Module (CMM) prior to version 2.0.…
• CVE-2018-9074For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.…