CVE-2018-9086

Legacy Server BMC Remote Command Injection

State: Published
Severity: Not scored
Published: Nov 16, 2018
Updated: Aug 5, 2024
Reserved: Mar 27, 2018

Description

In some Lenovo ThinkServer-branded servers, a command injection vulnerability exists in the BMC firmware download command. This allows a privileged user to download and execute arbitrary code inside the BMC. This can only be exploited by authorized privileged users.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
ThinkServer BMCLenovo	before variesAffected

References

https://support.lenovo.com/us/en/solutions/LEN-23836

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.