CVE-2023-2992

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-06-26 · updated 2026-06-17
Weakness: CWE-405

Description

An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions. Rebooting SMM or FPC will restore access to the management web server.

Affected products

Lenovo Nextscale N1200 Enclosure Firmware: before fhet60b-3.40 — fixed in fhet60b-3.40
Lenovo Thinkagile Cp-Cb-10 Firmware: before tesm38c-1.26 — fixed in tesm38c-1.26
Lenovo Thinkagile Cp-Cb-10E Firmware: before tesm38c-1.26 — fixed in tesm38c-1.26
Lenovo Thinkagile Hx Enclosure Certified Node Firmware: before tesm38c-1.26 — fixed in tesm38c-1.26
Lenovo Thinkagile Vx Enclosure Firmware: before tesm38c-1.26 — fixed in tesm38c-1.26
Lenovo Thinksystem D2 Enclosure Firmware: before tesm38c-1.26 — fixed in tesm38c-1.26
Lenovo Thinksystem Da240 Enclosure Firmware: before umsm10s-1.07 — fixed in umsm10s-1.07
Lenovo Thinksystem Dw612 Enclosure Firmware: before umsm10s-1.07 — fixed in umsm10s-1.07

How to fix

Upgrade to a fixed version: Lenovo Nextscale N1200 Enclosure Firmware fhet60b-3.40; Lenovo Thinkagile Cp-Cb-10 Firmware tesm38c-1.26; Lenovo Thinkagile Cp-Cb-10E Firmware tesm38c-1.26; Lenovo Thinkagile Hx Enclosure Certified Node Firmware tesm38c-1.26; Lenovo Thinkagile Vx Enclosure Firmware tesm38c-1.26; Lenovo Thinksystem D2 Enclosure Firmware tesm38c-1.26; Lenovo Thinksystem Da240 Enclosure Firmware umsm10s-1.07; Lenovo Thinksystem Dw612 Enclosure Firmware umsm10s-1.07. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-2992 or the next vulnerability affects your stack