title: CMM Security Vulnerability
description: Lenovo Chassis Management Module (CMM) prior to version 2.0.0 utilizes a hardcoded encryption key to protect certain secrets. Possession of the key can allow an attacker that has already compromised the server to decrypt these secrets.
problem types: Hardcoded Encryption Key
affected:
{
product: Chassis Management Module (CMM)
vendor: Lenovo
versions:
lessThan: 2.0.0, status: affected, version: unspecified, versionType: custom
}
solutions: Update to CMM v 2.0.0 or higher