CVE-2018-9084 : In System Management Module (SMM) versions prior to 1.06, if an attacker manages

In System Management Module (SMM) versions prior to 1.06, if an attacker manages to log in to the device OS, the validation of software updates can be circumvented.

Published 2018-11-27 14:29:01

Updated 2019-10-03 00:03:26

Source Lenovo Group Ltd.

View at NVD, CVE.org

Products affected by CVE-2018-9084

Lenovo » System Management Module Firmware
Versions before (<) 1.06
cpe:2.3:o:lenovo:system_management_module_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkagile Hx Enclosure 7x81 » Version: N/A
When used together with: Lenovo » Thinkagile Hx Enclosure 7y87 » Version: N/A
When used together with: Lenovo » Thinkagile Hx Enclosure 7z02 » Version: N/A
When used together with: Lenovo » Thinkagile Vx Enclosure 7y11 » Version: N/A
When used together with: Lenovo » Thinkagile Vx Enclosure 7y91 » Version: N/A
When used together with: Lenovo » Thinksystem D2 Enclosure 7x20 » Version: N/A
When used together with: Lenovo » Thinksystem Modular Enclosure 7x22 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2018-9084

EPSS FAQ

0.22%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 42 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-9084

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.0	MEDIUM	AV:N/AC:L/Au:S/C:N/I:P/A:N	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
6.5	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

References for CVE-2018-9084

https://support.lenovo.com/us/en/solutions/LEN-24374

System Management Module Vulnerabilities - US
Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2018-9084

Products affected by CVE-2018-9084

Exploit prediction scoring system (EPSS) score for CVE-2018-9084

CVSS scores for CVE-2018-9084

References for CVE-2018-9084