Vulnerability in Lenovo Fan Power Controller (Fpc)
CVE-2023-2992
An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions. Rebooting SMM or FPC will restore access to the management web server.
EPSS: 0.006 (45.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Lenovo Fan Power Controller (Fpc) — versions various
- Lenovo Nextscale_n1200_enclosure
- Lenovo Nextscale_n1200_enclosure_firmware
- Lenovo System Management Module (Smm) — versions various
- Lenovo Thinkagile_cp-cb-10
- Lenovo Thinkagile_cp-cb-10e
- Lenovo Thinkagile_cp-cb-10e_firmware
- Lenovo Thinkagile_cp-cb-10_firmware
- Lenovo Thinkagile_hx_enclosure_certified_node
- Lenovo Thinkagile_hx_enclosure_certified_node_firmware
Weakness classification (CWE)
References
- psirt@lenovo.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-2992?
- CVE-2023-2992 is a high-severity vulnerability in Lenovo Fan Power Controller (Fpc), classified under Asymmetric Resource Consumption (Amplification). CVSS score: 7.5/10. Published 2023-06-26.
- How severe is CVE-2023-2992?
- High severity. CVSS v3 base score is 7.5 out of 10.