CVE-2018-16089: System Management Module Vulnerabilities
Published Nov 27, 2018
·Updated
In System Management Module (SMM) versions prior to 1.06, a field in the header of SMM firmware update images is insufficiently sanitized, allowing post-authentication command injection on the SMM as the root user.
Affected Software
8 affected components
Lenovo System Management Module Firmware<1.06
Lenovo Thinkagile Hx Enclosure 7x81
Lenovo Thinkagile Hx Enclosure 7y87
Lenovo Thinkagile Hx Enclosure 7z02
Lenovo Thinkagile Vx Enclosure 7y11
Lenovo Thinkagile Vx Enclosure 7y91
Lenovo Thinksystem D2 Enclosure 7x20
Lenovo Thinksystem Modular Enclosure 7x22
Remediation
Information
Update SMM firmware
Event History
Nov 27, 2018
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
RemedyDescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2018-16089?
CVE-2018-16089 is classified as a high severity vulnerability due to the potential for post-authentication command injection as the root user.
2
How do I fix CVE-2018-16089?
To fix CVE-2018-16089, upgrade the System Management Module firmware to version 1.06 or later.
3
What systems are affected by CVE-2018-16089?
CVE-2018-16089 affects Lenovo System Management Module firmware versions prior to 1.06.
4
What type of vulnerability is CVE-2018-16089?
CVE-2018-16089 is a command injection vulnerability that allows attackers to execute arbitrary commands post-authentication.
5
Is CVE-2018-16089 a local or remote vulnerability?
CVE-2018-16089 is a local vulnerability that requires an authenticated user to exploit.