CVE-2023-2992
An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC...
An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions. Rebooting SMM or FPC will restore access to the management web server.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions. Rebooting SMM or FPC will restore access to the management web server.
- Record
CVE-2023-2992- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-405
- Updated
- 2026-11-02
EUVDEUVD-2023-34428
An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions. Rebooting SMM or FPC will restore access to the management web server.
- Record
EUVD-2023-34428- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-gqhx-wxjr-rphx
An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC...
An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions. Rebooting SMM or FPC will restore access to the management web server.
- Record
GHSA-gqhx-wxjr-rphx- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-405
- Updated
- 2026-11-02
NVD
An unauthenticated denial of service vulnerability exists in the SMM v1, SMM v2, and FPC management web server which can be triggered under crafted conditions. Rebooting SMM or FPC will restore access to the management web server.
- Record
CVE-2023-2992- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-405
- Updated
- 2026-11-02
Affected products
- lenovo fan power controller (fpc)
- lenovo nextscale n1200 enclosure firmware
- lenovo system management module (smm)
- lenovo thinkagile cp-cb-10 firmware
- lenovo thinkagile cp-cb-10e firmware
- lenovo thinkagile hx enclosure certified node firmware
- lenovo thinkagile hx enclosure firmware
- lenovo thinkagile vx enclosure firmware
- lenovo thinksystem d2 enclosure firmware
- lenovo thinksystem da240 enclosure firmware
- lenovo thinksystem dw612 enclosure firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-2992 is a high vulnerability (CVSS 7.5) in Lenovo Fan Power Controller (fpc), published June 26, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.62%, the 49th percentile. No source names a fixed version.