RCE in Lenovo Nextscale_n1200_enclosure
CVE-2024-2659
A command injection vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user with elevated privileges to execute system commands when performing a specific administrative function.
Vulnerability class: Command Injection (OS Command Injection)
EPSS: 0.011 (62.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Lenovo Nextscale_n1200_enclosure
- Lenovo Nextscale_n1200_enclosure_firmware
- Lenovo Smm, Smm2, Fpc — versions various
- Lenovo Thinkagile_2u4n
- Lenovo Thinkagile_2u4n_firmware
- Lenovo Thinkagile_cp-cb-10
- Lenovo Thinkagile_cp-cb-10e
- Lenovo Thinkagile_cp-cb-10e_firmware
- Lenovo Thinkagile_cp-cb-10_firmware
- Lenovo Thinkagile_hx1021
Weakness classification (CWE)
References
- psirt@lenovo.com (Vendor Advisory)
Frequently asked questions
- What is CVE-2024-2659?
- CVE-2024-2659 is a high-severity vulnerability in Lenovo Nextscale_n1200_enclosure, classified under OS Command Injection. CVSS score: 7.2/10. Published 2024-04-15.
- How severe is CVE-2024-2659?
- High severity. CVSS v3 base score is 7.2 out of 10.