CVE-2018-9086

Legacy Server BMC Remote Command Injection

N/A

Published: November 16, 2018 at 02:00 PM UTC

Updated: June 17, 2026 at 02:06 AM UTC

8 products affected across 1 vendorThinkserver RD340 FirmwareThinkserver RD440 FirmwareThinkserver TD340 Firmware

Using ThinkServer BMC by Lenovo?

Get instant alerts when new vulnerabilities affect ThinkServer BMC - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

N/A

Exploit prediction

EPSS 2%

Description

In some Lenovo ThinkServer-branded servers, a command injection vulnerability exists in the BMC firmware download command. This allows a privileged user to download and execute arbitrary code inside the BMC. This can only be exploited by authorized privileged users.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Thinkserver RD340 Firmware · Lenovo

95%

v < 64.00

Affected range stops below 64.00, so it looks safe — our inference, not a vendor statement

lenovo-thinkserver-rd340 (same device)

Thinkserver RD440 Firmware · Lenovo

95%

v < 64.00

Affected range stops below 64.00, so it looks safe — our inference, not a vendor statement

lenovo-thinkserver-rd440 (same device)

Thinkserver RD640 Firmware · Lenovo

95%

v < 64.00

Affected range stops below 64.00, so it looks safe — our inference, not a vendor statement

lenovo-thinkserver-rd640 (same device)

Thinkserver TD340 Firmware · Lenovo

95%

v < 60.00

Affected range stops below 60.00, so it looks safe — our inference, not a vendor statement

lenovo-thinkserver-td340 (same device)

ThinkServer RD340 · Lenovo

60%

v < varies

Affected range stops below varies, so it looks safe — our inference, not a vendor statement

ThinkServer RD440 · Lenovo

60%

v < varies

Affected range stops below varies, so it looks safe — our inference, not a vendor statement

ThinkServer RD640 · Lenovo

60%

v < varies

Affected range stops below varies, so it looks safe — our inference, not a vendor statement

ThinkServer TD340 · Lenovo

60%

v < varies

Affected range stops below varies, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://support.lenovo.com/us/en/solutions/LEN-23836

References (1)

x_refsource_CONFIRMPatchThird Party Advisory

Source: [email protected]

https://support.lenovo.com/us/en/solutions/LEN-23836

CVSS

6.5MEDIUM[email protected]

Confidentiality: PARTIAL
Integrity: PARTIAL
Availability: PARTIAL

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-78

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card