medium5.9
CVE-2018-9073
Lenovo Chassis Management Module (CMM) prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets.
Impact
Lenovo Chassis Management Module (CMM) prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow an attacker that has already compromised the server to decrypt these secrets.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lenovo | Chassis Management Module Firmware | before 2.0.0 |