What’s Vulnerable › Vulnerabilities

CVE-2018-9071: CMM Security Vulnerability

• Severity: medium (CVSS 5.3 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2018-11-16 · updated 2026-06-17
• Weakness: CWE-200

Description

Lenovo Chassis Management Module (CMM) prior to version 2.0.0 allows unauthenticated users to retrieve information related to the current authentication configuration settings. Exposed settings relate to password lengths, expiration, and lockout configuration.

Affected products

• Lenovo Chassis Management Module (CMM): before 2.0.0 — fixed in 2.0.0

How to fix

Upgrade to a fixed version: Lenovo Chassis Management Module (CMM) 2.0.0. Check the vendor advisory for mitigations.

References

• https://support.lenovo.com/us/en/solutions/LEN-23806
• https://support.lenovo.com/us/en/solutions/LEN-23806

Get alerted when CVE-2018-9071 or the next vulnerability affects your stack