CVE-2018-9073

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

Lenovo Chassis Management Module (CMM) prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow an attacker that has already compromised the server to decrypt these secrets.

Metrics

CVSS 3.0 5.9/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-798

Affected software

No affected versions have been published.

Timeline

Published
Nov 16, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-90746.5For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file upload functionality of the Content Explorer appCVE-2018-90758.1For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when joining a PersonalCloud setup, an attacker can craftCVE-2018-90768.1For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when changing the name of a share, an attacker can craft CVE-2018-90778.1For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, when changing the name of a share, an attacker can craft CVE-2018-90788.8For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the Content Explorer application grants users the abilityCVE-2018-90799.8For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, adversaries can craft URLs to modify the Document Object CVE-2018-90805.9For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, by setting the Iomega cookie to a known value before loggCVE-2018-90814.7For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the file name used for assets accessible through the ContCVE-2018-90828.8For some Iomega, Lenovo, LenovoEMC NAS devices versions 4.1.402.34662 and earlier, the password changing functionality available to authentiCVE-2018-90838.1In System Management Module (SMM) versions prior to 1.06, the SMM contains weak default root credentials which could be used to log in to thCVE-2018-90846.5In System Management Module (SMM) versions prior to 1.06, if an attacker manages to log in to the device OS, the validation of software updaCVE-2018-90854.9A write protection lock bit was left unset after boot on an older generation of Lenovo and IBM System x servers, potentially allowing an att
CVE-2018-9073: Medium severity, CVSS 5.9 | Vulnix