ASPEED AST-series BMC Vulnerability - US

Lenovo Security Advisory: LEN-26252

Potential Impact: Privilege escalation

Severity: High

Scope of Impact: Industry-wide

CVE Identifier: CVE-2019-6260

Summary Description:

An industry-wide vulnerability affecting ASPEED AST-series Baseboard Management Controllers (BMCs) used in certain servers and storage devices can allow arbitrary read and write access to the BMC’s physical address space from the host. ThinkSystem and System x servers are not affected.

Mitigation Strategy for Customers (what you should do to protect yourself):

Upgrade to the firmware version (or newer) indicated for your model in the Product Impact section below.

Product Impact: