CVE-2023-2993
A valid, authenticated user with limited privileges may be able to use specifically crafted web...
A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute.
- Record
CVE-2023-2993- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-281
- Updated
- 2026-11-02
EUVDEUVD-2023-34429
A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute.
- Record
EUVD-2023-34429- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6fq2-7qrw-4c53
A valid, authenticated user with limited privileges may be able to use specifically crafted web...
A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute.
- Record
GHSA-6fq2-7qrw-4c53- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - Weakness
- CWE-281
- Updated
- 2026-11-02
NVD
A valid, authenticated user with limited privileges may be able to use specifically crafted web management server API calls to execute a limited number of commands on SMM v1, SMM v2, and FPC that the user does not normally have sufficient privileges to execute.
- Record
CVE-2023-2993- CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N - CVSS 3.1
- 6.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-281
- Updated
- 2026-11-02
Affected products
- lenovo fan power controller (fpc)
- lenovo nextscale n1200 enclosure firmware
- lenovo system management module (smm)
- lenovo thinkagile cp-cb-10 firmware
- lenovo thinkagile cp-cb-10e firmware
- lenovo thinkagile hx enclosure certified node firmware
- lenovo thinkagile vx enclosure firmware
- lenovo thinksystem d2 enclosure firmware
- lenovo thinksystem da240 enclosure firmware
- lenovo thinksystem dw612 enclosure firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-2993 is a medium vulnerability (CVSS 5.4) in Lenovo Fan Power Controller (fpc), published June 26, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. No source names a fixed version.