System Management Module Firmware
Vendor:
First CVE: Nov 27, 2018 · Active for 7 years
9
Total CVEs
More Total CVEs than 88% of tracked products
9.0
Avg CVEs / Year
Higher CVE frequency than 95% of tracked products
7.3
Avg CVSS
Higher Avg CVSS than 50% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact System Management Module Firmware over time
Volume of CVEsAvg CVSS Base Score
First CVE
Nov 27, 2018
7 years ago
Most Recent CVE
Nov 27, 2018
2,800 days ago
CVE Severity & Scoring
System Management Module Firmware9 CVEs
33%
67%
All CVEs353,173 CVEs
45%
40%
11%
MediumHigh
Attack Vector
Local0 (0.0%)
Network9 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low2 (22.2%)
High7 (77.8%)
Unknown0 (0.0%)
User Interaction
None8 (88.9%)
Unknown0 (0.0%)
Required1 (11.1%)
Privileges Required
Low3 (33.3%)
High0 (0.0%)
None6 (66.7%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (9 CVEs).
9 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2018-9083HIGH In System Management Module (SMM) versions prior to 1.06, the SMM contains weak default root credentials which could be used to log in to the device OS -- if the attacker manages t | Nov 27, 2018 | 8.1 | 26 | NO | NO |
CVE-2018-16094HIGH In System Management Module (SMM) versions prior to 1.06, an internal SMM function that retrieves configuration settings is prone to a buffer overflow. | Nov 27, 2018 | 8.1 | 25 | NO | NO |
CVE-2018-16092HIGH In System Management Module (SMM) versions prior to 1.06, the FFDC feature includes the collection of SMM system files containing sensitive information; notably, the SMM user accou | Nov 27, 2018 | 8.1 | 25 | NO | NO |
CVE-2018-16091HIGH In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to several buffer overflows. | Nov 27, 2018 | 8.1 | 25 | NO | NO |
CVE-2018-16089HIGH In System Management Module (SMM) versions prior to 1.06, a field in the header of SMM firmware update images is insufficiently sanitized, allowing post-authentication command inje | Nov 27, 2018 | 7.5 | 24 | NO | NO |
CVE-2018-16090HIGH In System Management Module (SMM) versions prior to 1.06, the SMM certificate creation and parsing logic is vulnerable to post-authentication command injection. | Nov 27, 2018 | 7.5 | 23 | NO | NO |
CVE-2018-9084MEDIUM In System Management Module (SMM) versions prior to 1.06, if an attacker manages to log in to the device OS, the validation of software updates can be circumvented. | Nov 27, 2018 | 6.5 | 22 | NO | NO |
CVE-2018-16096MEDIUM In System Management Module (SMM) versions prior to 1.06, the SMM web interface for changing Enclosure VPD fails to sufficiently sanitize all input for HTML tags, possibly opening | Nov 27, 2018 | 6.1 | 20 | NO | NO |
CVE-2018-16095MEDIUM In System Management Module (SMM) versions prior to 1.06, the SMM records hashed passwords to a debug log when user authentication fails. | Nov 27, 2018 | 5.9 | 20 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (9 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (9 CVEs).
Media Mentions
Signals from CVEs in this product scope (9 CVEs).
Top CNAs Publishing CVEs For System Management Module Firmware
Top CWEs
Versions
No cataloged versions.