CVE-2021-3723
A command injection vulnerability was reported in the Integrated Management Module (IMM) of legacy IBM System x 3550 M3 and IBM System x 3650 M3 servers that could allow the execution of operating system commands over an authenticated SSH or Telnet…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.94%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A command injection vulnerability was reported in the Integrated Management Module (IMM) of legacy IBM System x 3550 M3 and IBM System x 3650 M3 servers that could allow the execution of operating system commands over an authenticated SSH or Telnet session.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.94% probability · 79th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- ibm/system x3550 m3 firmware · ibm/system x3650 m3 firmware
- Source
- psirt@lenovo.com
References
- https://support.lenovo.com/us/en/product_security/LEN-66347Third Party Advisory
- https://support.lenovo.com/us/en/product_security/LEN-66347Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.