Lenovo Thinkstation P920 Firmware — known CVE vulnerabilities

Every CVE whose affected-product data names Lenovo Thinkstation P920 Firmware, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (15)

• CVE-2023-0683 — CVSS 8.3 (high): A valid, authenticated XCC user with read only access may gain elevated privileges through a specifically crafted API call.
• CVE-2019-0135 — CVSS 7.8 (high): Improper permissions in the installer for Intel(R) Accelerated Storage Manager in Intel(R) RSTe before version 5.5.0.2015 may allow an…
• CVE-2019-0130 — CVSS 7.4 (high): Reflected XSS in web interface for Intel(R) Accelerated Storage Manager in Intel(R) RSTe before version 5.5.0.2015 may allow an…
• CVE-2023-29057 — CVSS 7.3 (high): A valid XCC user's local account permissions overrides their active directory permissions under specific configurations. This could lead to…
• CVE-2022-34884 — CVSS 7.2 (high): A buffer overflow exists in the Remote Presence subsystem which can potentially allow valid, authenticated users to cause a recoverable…
• CVE-2023-29058 — CVSS 6.4 (medium): A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass…
• CVE-2020-8321 — CVSS 6.4 (medium): A potential vulnerability in the SMI callback function used in the System Lock Preinstallation driver in some Lenovo Notebook and…
• CVE-2021-3519 — CVSS 6.4 (medium): A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password…
• CVE-2023-25492 — CVSS 6.3 (medium): A valid, authenticated user may be able to trigger a denial of service of the XCC web user interface or other undefined behavior through a…
• CVE-2023-29056 — CVSS 5.3 (medium): A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC. To be vulnerable, XCC…
• CVE-2019-6190 — CVSS 5.0 (medium): Lenovo was notified of a potential denial of service vulnerability, affecting various versions of BIOS for Lenovo Desktop, Desktop - All in…
• CVE-2023-25495 — CVSS 4.9 (medium): A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to…
• CVE-2022-40136 — CVSS 4.4 (medium): An information leak vulnerability in SMI Handler used to configure platform settings over WMI in some Lenovo models may allow an attacker…
• CVE-2019-6156 — CVSS 3.3 (low): In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an…
• CVE-2022-34888 — CVSS 2.7 (low): The Remote Mount feature can potentially be abused by valid, authenticated users to make connections to internal services that may not…