1. Home
  2. CVE Database
  3. CVE-2018-9084
MEDIUM · 6.5

CVE-2018-9084

In System Management Module (SMM) versions prior to 1.06, if an attacker manages to log in to the device OS, the validation of software updates can be circumvented.

Vulnerability Description

In System Management Module (SMM) versions prior to 1.06, if an attacker manages to log in to the device OS, the validation of software updates can be circumvented.

CVSS Score

6.5

MEDIUM

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
HIGH
Availability
NONE

Affected Products

VendorProductVersions
LenovoSystem Management Module Firmware< 1.06
LenovoThinkagile Hx Enclosure 7X81-
LenovoThinkagile Hx Enclosure 7Y87-
LenovoThinkagile Hx Enclosure 7Z02-
LenovoThinkagile Vx Enclosure 7Y11-
LenovoThinkagile Vx Enclosure 7Y91-
LenovoThinksystem D2 Enclosure 7X20-
LenovoThinksystem Modular Enclosure 7X22-

References

FAQ

What is CVE-2018-9084?

CVE-2018-9084 is a vulnerability with a CVSS score of 6.5 (MEDIUM). In System Management Module (SMM) versions prior to 1.06, if an attacker manages to log in to the device OS, the validation of software updates can be circumvented.

How severe is CVE-2018-9084?

CVE-2018-9084 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-9084?

Check the references section above for vendor advisories and patch information. Affected products include: Lenovo System Management Module Firmware, Lenovo Thinkagile Hx Enclosure 7X81, Lenovo Thinkagile Hx Enclosure 7Y87, Lenovo Thinkagile Hx Enclosure 7Z02, Lenovo Thinkagile Vx Enclosure 7Y11.