Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.9

Lenovo CMM firmware may reveal secrets after server breach

CVE-2018-9073 · published 7 years ago
Summary

The Lenovo chassis management module firmware before version 2.0.0 uses a fixed encryption key to protect data. If an attacker already has control of the server, they can use that key to read the protected information. Update the firmware to version 2.0.0 or later to eliminate this risk.

What to do
  • Update lenovo chassis_management_module_firmware to version 2.0.0 or later.
Affected software
VendorProductAffected versions
lenovo chassis_management_module_firmware < 2.0.0
cpe:2.3:o:lenovo:chassis_management_module_firmware:*:*:*:*:*:*:*:*
Original advisory text
Lenovo Chassis Management Module (CMM) prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow an attacker that has already compromise...
Lenovo Chassis Management Module (CMM) prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow an attacker that has already compromised the server to decrypt these secrets.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-798Use of Hard-coded Credentials
Timeline
Published16 Nov 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-9073 · NVD
Track software like this
Free during beta