CVE-2018-9086

Legacy Server BMC Remote Command Injection

published November 16, 2018

CVSS
—
EPSS
2%
Percentile
83.9
In the wild
Unconfirmed
What it is

In some Lenovo ThinkServer-branded servers, a command injection vulnerability exists in the BMC firmware download command. This allows a privileged user to download and execute arbitrary code inside the BMC. This can only be exploited by authorized privileged users.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02419 · 83.9th percentile
Published
2018-11-16T14:00Z
EPSS history
Timeline
  • 16 NOV 14:00Z
    Legacy Server BMC Remote Command Injection
    cvelistv5