CWE
798
Advisory Published
Updated

CVE-2018-9083: System Management Module Vulnerabilities

First published: Tue Nov 27 2018(Updated: )

In System Management Module (SMM) versions prior to 1.06, the SMM contains weak default root credentials which could be used to log in to the device OS -- if the attacker manages to enable SSH or Telnet connections via some other vulnerability.

Credit: psirt@lenovo.com

Affected SoftwareAffected VersionHow to fix
Lenovo System Management Module firmware<1.06
Lenovo ThinkAgile HX Enclosure 7x81
Lenovo ThinkAgile HX Enclosure 7Y87
Lenovo ThinkAgile HX Enclosure 7Z02
Lenovo ThinkAgile VX Enclosure 7Y11
Lenovo ThinkAgile VX Enclosure 7Y91
Lenovo ThinkSystem D2 Enclosure
Lenovo ThinkSystem Modular Enclosure 7x22

Remedy

Update SMM firmware

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Frequently Asked Questions

  • What is the severity of CVE-2018-9083?

    CVE-2018-9083 has a critical severity rating due to the presence of weak default root credentials allowing unauthorized access.

  • How do I fix CVE-2018-9083?

    To fix CVE-2018-9083, update the Lenovo System Management Module firmware to version 1.06 or later.

  • What devices are affected by CVE-2018-9083?

    CVE-2018-9083 affects Lenovo System Management Module firmware versions prior to 1.06.

  • What can an attacker do with CVE-2018-9083?

    An attacker can potentially log in to the device OS using weak default credentials if SSH or Telnet is enabled.

  • Is there a known exploit for CVE-2018-9083?

    While there is no public exploit specifically noted for CVE-2018-9083, the vulnerability itself poses a significant security risk.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203