CVE-2023-2992 : An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which c

An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions. Rebooting SMM or FPC will restore access to the management web server.

Published 2023-06-26 20:15:10

Updated 2023-07-05 17:27:57

Source Lenovo Group Ltd.

View at NVD, CVE.org

Vulnerability category: Denial of service

Exploit prediction scoring system (EPSS) score for CVE-2023-2992

EPSS FAQ

0.08%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 34 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2023-2992

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	Lenovo Group Ltd.
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2023-2992

CWE-400 Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.

Assigned by: psirt@lenovo.com (Secondary)

Products affected by CVE-2023-2992

Lenovo » Nextscale N1200 Enclosure Firmware
Versions before (<) fhet60b-3.40
cpe:2.3:o:lenovo:nextscale_n1200_enclosure_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Nextscale N1200 Enclosure » Version: N/A
Lenovo » Thinkagile Hx Enclosure Certified Node Firmware
Versions before (<) tesm38c-1.26
cpe:2.3:o:lenovo:thinkagile_hx_enclosure_certified_node_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkagile Hx Enclosure Certified Node » Version: N/A
Lenovo » Thinkagile Vx Enclosure Firmware
Versions before (<) tesm38c-1.26
cpe:2.3:o:lenovo:thinkagile_vx_enclosure_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkagile Vx Enclosure » Version: N/A
Lenovo » Thinksystem D2 Enclosure Firmware
Versions before (<) tesm38c-1.26
cpe:2.3:o:lenovo:thinksystem_d2_enclosure_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinksystem D2 Enclosure » Version: N/A
Lenovo » Thinkagile Cp-cb-10 Firmware
Versions before (<) tesm38c-1.26
cpe:2.3:o:lenovo:thinkagile_cp-cb-10_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkagile Cp-cb-10 » Version: N/A
Lenovo » Thinkagile Cp-cb-10e Firmware
Versions before (<) tesm38c-1.26
cpe:2.3:o:lenovo:thinkagile_cp-cb-10e_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinkagile Cp-cb-10e » Version: N/A
Lenovo » Thinksystem Da240 Enclosure Firmware
Versions before (<) umsm10s-1.07
cpe:2.3:o:lenovo:thinksystem_da240_enclosure_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinksystem Da240 Enclosure » Version: N/A
Lenovo » Thinksystem Dw612 Enclosure Firmware
Versions before (<) umsm10s-1.07
cpe:2.3:o:lenovo:thinksystem_dw612_enclosure_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Lenovo » Thinksystem Dw612 Enclosure » Version: N/A

Vulnerability Details : CVE-2023-2992

Exploit prediction scoring system (EPSS) score for CVE-2023-2992

CVSS scores for CVE-2023-2992

CWE ids for CVE-2023-2992

References for CVE-2023-2992

Products affected by CVE-2023-2992