CVE-2018-16095: System Management Module Vulnerabilities
Published Nov 27, 2018
·Updated
In System Management Module (SMM) versions prior to 1.06, the SMM records hashed passwords to a debug log when user authentication fails.
Affected Software
8 affected components
Lenovo System Management Module Firmware<1.06
Lenovo Thinkagile Hx Enclosure 7x81
Lenovo Thinkagile Hx Enclosure 7y87
Lenovo Thinkagile Hx Enclosure 7z02
Lenovo Thinkagile Vx Enclosure 7y11
Lenovo Thinkagile Vx Enclosure 7y91
Lenovo Thinksystem D2 Enclosure 7x20
Lenovo Thinksystem Modular Enclosure 7x22
Remediation
Information
Update SMM firmware
Event History
Nov 27, 2018
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
RemedyDescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2018-16095?
CVE-2018-16095 is considered a high-severity vulnerability due to the exposure of hashed passwords in debug logs.
2
How do I fix CVE-2018-16095?
To remediate CVE-2018-16095, update your System Management Module firmware to version 1.06 or later.
3
What products are affected by CVE-2018-16095?
CVE-2018-16095 affects the Lenovo System Management Module firmware versions prior to 1.06.
4
What type of information is exposed in CVE-2018-16095?
CVE-2018-16095 exposes hashed passwords that are recorded in a debug log upon failed user authentication.
5
Is my Lenovo ThinkAgile HX Enclosure vulnerable to CVE-2018-16095?
No, the Lenovo ThinkAgile HX Enclosures 7x81, 7y87, and 7z02 are not affected by CVE-2018-16095.