CVE-2015-3324

EUVD-2015-3370
The ThinkServer System Manager (TSM) Baseboard Management Controller before firmware 1.27.73476 for ThinkServer RD350, RD450, RD550, RD650, and TD350 does not validate server certificates during an "encrypted remote KVM session," which allows man-in-the-middle attackers to spoof servers.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
4.3 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 33%
Affected Products (NVD)
VendorProductVersion
lenovothinkserver_system_manager_baseboard_management_controller_firmware
118.71532
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://support.lenovo.com/us/en/product_security/tsm_weak_pw
http://www.securityfocus.com/bid/74199
http://support.lenovo.com/us/en/product_security/tsm_weak_pw
http://www.securityfocus.com/bid/74199