Database/Control plane, storage & DevOps
Lenovo ThinkSystem SMM / SMM2 and FPC (command injection): An authenticated user with elevated privileges executes
CVSS 7.2CVE-2024-2659Control plane, storage & DevOpscurated
Impact
An authenticated user with elevated privileges executes system commands on the chassis System Management Module or Fan/Power Controller - the components that own power and thermal control for a whole enclosure of ThinkSystem nodes.
Who can reach it
Authenticated high-privilege access to the SMM/SMM2 or FPC management interface.
What to do
Apply the Lenovo firmware update per LEN-140420. Chassis-level management firmware flash; nodes keep running but chassis management is interrupted during the update.
References
Related entries
- Schneider Electric Data Center Expert - upgrade bundle signature verification: Improper cryptographic signatureCVE-2024-8531 · Schneider Electric Data Center Expert - upgrade bundle signature verificationHigh
- HashiCorp Vault: Operator with write on the root namespace identity endpoint escalates self/others to the root policyCVE-2024-9180 · HashiCorp VaultHigh
- Palo Alto PAN-OS: Admin with mgmt-interface access performs firewall actions as rootCVE-2024-9474 · Palo Alto PAN-OSHigh
- Volcano (scheduler, Elastic service and extender plugin response handling): The scheduler reads unbounded responsesCVE-2025-32777 · Volcano (scheduler, Elastic service and extender plugin response handling)High
- Oracle ZFS Storage Appliance Kit: HTTP-reachable flaw in Block Storage allows full appliance takeoverCVE-2025-62290 · Oracle ZFS Storage Appliance Kit 8.8 (Block Storage component)High
- AMD CPUs - attacker influence over RDSEED entropy: A local attacker can influence the values RDSEED returns, causingCVE-2025-62626 · AMD CPUs - attacker influence over RDSEED entropyHigh
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.