CVE-2023-2993

State: Published
Severity: 5.4 Medium
Published: Jun 26, 2023
Updated: Nov 6, 2024
Reserved: May 30, 2023

Description

A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute.

Scores

CVSS	Score	Vector	Source
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N	lenovo

Weaknesses

CWE-281 Improper Preservation of Permissions

Affected Products

Product	Versions
System Management Module (SMM)Lenovo	variousAffected
Fan Power Controller (FPC)Lenovo	variousAffected

References

https://support.lenovo.com/us/en/product_security/LEN-127357

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.