CVE-2023-4856

Name of the Vulnerable Software and Affected Versions Lenovo ThinkSystem, ThinkAgile, NeXtScale, and Lenovo CP-CB-10 (affected versions not specified) SMM/SMM2 and FPC (affected versions not specified)

Description A format string vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute arbitrary commands on a specific API endpoint. This issue exists due to the lack of measures to neutralize special elements used in the operating system command. Exploitation of the vulnerability may allow a remote attacker to execute arbitrary commands.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.