CVE-2018-16090: System Management Module Vulnerabilities
Published Nov 27, 2018
·Updated
In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to post-authentication command injection.
Affected Software
8 affected components
Lenovo System Management Module Firmware<1.06
Lenovo Thinkagile Hx Enclosure 7x81
Lenovo Thinkagile Hx Enclosure 7y87
Lenovo Thinkagile Hx Enclosure 7z02
Lenovo Thinkagile Vx Enclosure 7y11
Lenovo Thinkagile Vx Enclosure 7y91
Lenovo Thinksystem D2 Enclosure 7x20
Lenovo Thinksystem Modular Enclosure 7x22
Remediation
Information
Update SMM firmware
Event History
Nov 27, 2018
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
RemedyDescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2018-16090?
CVE-2018-16090 is classified as a high severity vulnerability due to the potential for post-authentication command injection.
2
How do I fix CVE-2018-16090?
To fix CVE-2018-16090, upgrade to System Management Module firmware version 1.06 or later.
3
Which systems are affected by CVE-2018-16090?
CVE-2018-16090 affects Lenovo System Management Module versions prior to 1.06.
4
What type of vulnerability is CVE-2018-16090?
CVE-2018-16090 is a post-authentication command injection vulnerability.
5
Is CVE-2018-16090 a hardware or software vulnerability?
CVE-2018-16090 is a software vulnerability affecting the firmware of Lenovo System Management Module.