Read the docs
TI-2018-06589 Aliases CVE-2018-9073GHSA-9jw6-h58q-m3jf

CMM Security Vulnerability

Priority LOW 27CWE-798Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-798.

Summary

Lenovo Chassis Management Module (CMM) prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow an attacker that has already compromised the server to decrypt these secrets.

Why it matters now

EPSS 0.00508 43rd percentileScored 2026-11-07
Fix Fixed Chassis Management Module (CMM) (Lenovo): 2.0.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LenovoChassis Management Module (CMM)before 2.0.02.0.0Patch availableCNA
  • Chassis Management Module (CMM) VendorLenovo Affected before 2.0.0 Fixed in 2.0.0 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:o:lenovo:chassis_management_module_firmware:*:*:*:*:*:*:*:*before 2.0.0VulnerableLenovo
cpe:2.3:h:lenovo:chassis_management_module:-:*:*:*:*:*:*:*not specified by NVDRunning onLenovo
  • cpe:2.3:o:lenovo:chassis_management_module_firmware:*:*:*:*:*:*:*:* Versions before 2.0.0 Vulnerable ·Lenovo
  • cpe:2.3:h:lenovo:chassis_management_module:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo

Remediation

  • Fix · CNA Chassis Management Module (CMM) (Lenovo) Fixed in 2.0.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Lenovo Chassis Management Module (CMM) 2.0.0

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-9073
  2. 2026-10-03 Alias added: GHSA-9jw6-h58q-m3jf

References

Advisory 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences