CVE-2023-2992
Last modified
CVE-2023-2992 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions. Rebooting SMM or FPC will restore access to the management web server.. EPSS estimates a 0.52% chance of exploitation in the next 30 days.
Description
An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions. Rebooting SMM or FPC will restore access to the management web server.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Lenovo | Nextscale N1200 Enclosure Firmware | < fhet60b-3.40 |
| Lenovo | Thinkagile Cp-Cb-10 Firmware | < tesm38c-1.26 |
| Lenovo | Thinkagile Cp-Cb-10e Firmware | < tesm38c-1.26 |
| Lenovo | Thinkagile Hx Enclosure Certified Node Firmware | < tesm38c-1.26 |
| Lenovo | Thinkagile Vx Enclosure Firmware | < tesm38c-1.26 |
| Lenovo | Thinksystem D2 Enclosure Firmware | < tesm38c-1.26 |
| Lenovo | Thinksystem Da240 Enclosure Firmware | < umsm10s-1.07 |
| Lenovo | Thinksystem Dw612 Enclosure Firmware | < umsm10s-1.07 |
References
- https://support.lenovo.com/us/en/product_security/LEN-127357Vendor Advisory
- https://support.lenovo.com/us/en/product_security/LEN-127357Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-2992?
How severe is CVE-2023-2992?
How do I fix CVE-2023-2992?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-29914H3C Magic R200 version R200V100R004 was discovered to contai…4.9
- CVE-2023-29915H3C Magic R200 version R200V100R004 was discovered to contai…4.9
- CVE-2023-29916H3C Magic R200 version R200V100R004 was discovered to contai…4.9
- CVE-2023-29917H3C Magic R200 version R200V100R004 was discovered to contai…4.9
- CVE-2023-29918RosarioSIS 10.8.4 is vulnerable to CSV injection via the Per…5.4
- CVE-2023-29919SolarView Compact <= 6.0 is vulnerable to Insecure Permissio…9.1
- CVE-2023-29921PowerJob V4.3.1 is vulnerable to Incorrect Access Control vi…5.3
- CVE-2023-29922PowerJob V4.3.1 is vulnerable to Incorrect Access Control vi…5.3
- CVE-2023-29923PowerJob V4.3.1 is vulnerable to Insecure Permissions. via t…5.3
- CVE-2023-29924PowerJob V4.3.1 is vulnerable to Incorrect Access Control th…9.8
- CVE-2023-29926PowerJob V4.3.2 has unauthorized interface that causes remot…9.8
- CVE-2023-29927Versions of Sage 300 through 2022 implement role-based acces…4.3
Are you affected by CVE-2023-2992?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST