CVE-2019-6157: medium-severity vulnerability in Lenovo System x
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Lenovo server firmware accidentally includes the web server's private encryption key in support log files. This allows anyone with access to these logs to impersonate the server and intercept secure communications.
The FFDC feature in Lenovo System x IMM2 firmware exposes the web server's private key within generated support logs. An attacker with access to these diagnostic files (via local access, backup disclosure, or support channels) can obtain the private key, enabling man-in-the-middle attacks and session hijacking against the management interface.
In the same product, most dangerous first.