title: Legacy Server BMC Remote Command Injection
description: In some Lenovo ThinkServer-branded servers, a command injection vulnerability exists in the BMC firmware download command. This allows a privileged user to download and execute arbitrary code inside the BMC. This can only be exploited by authorized privileged users.
problem types: Arbitrary Code Execution
affected:
{
product: ThinkServer BMC
vendor: Lenovo
versions:
lessThan: varies, status: affected, version: unspecified, versionType: custom
}
solutions: Update BMC firmware