Vulnerability · Published Jun 26, 2023 · Assigned by lenovo
CVE-2023-2993
Medium 5.4
In plain English
A medium-severity security flaw in Fan Power Controller (FPC) from Lenovo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).
Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.3%top 78.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Lenovo | System Management Module (SMM) | various |
| Lenovo | Fan Power Controller (FPC) | various |
Weakness: CWE-281 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N