CVE-2018-16096
System Management Module Vulnerabilities
Vexday Risk Score
3Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS —EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
27 Nov 2018Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
In System Management Module (SMM) versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML tags, possibly opening a path for cross-site scripting.
Affected products
Lenovo · ThinkSystem SMMWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →