CVE-2024-2659: Lenovo Nextscale N1200 RCE Vulnerability

CVE-2024-2659 Overview

CVE-2024-2659 is a command injection vulnerability affecting Lenovo System Management Module (SMM/SMM2) and Fan Power Controller (FPC) firmware used in NextScale, ThinkAgile, and ThinkSystem enclosure and chassis products. An authenticated user with elevated privileges can execute arbitrary system commands by invoking a specific administrative function that fails to sanitize input passed to the underlying operating system shell. The flaw is classified as [CWE-78] OS Command Injection. Successful exploitation gives an attacker full command execution on the management controller, which sits at a highly privileged position in the data center management plane.

Critical Impact

An authenticated administrator can achieve arbitrary command execution on the SMM/SMM2 or FPC management controller, compromising chassis-wide management, telemetry, and power control.

Affected Products

• Lenovo NextScale N1200 Enclosure firmware (SMM/FPC)
• Lenovo ThinkAgile HX and VX series enclosure and node firmware (SMM/SMM2)
• Lenovo ThinkSystem D2, DA240, and DW612 enclosure firmware

Discovery Timeline

• 2024-04-15 - CVE-2024-2659 published to the National Vulnerability Database
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-2659

Vulnerability Analysis

The vulnerability resides in an administrative function exposed by the System Management Module (SMM/SMM2) and Fan Power Controller (FPC) firmware. These components manage chassis-level services such as thermal control, power distribution, node inventory, and remote management for Lenovo blade and dense-server enclosures. When an authenticated administrator invokes the affected function, user-supplied input is concatenated into a shell command without adequate validation or escaping. The management controller then executes the constructed string through an operating system shell, allowing injected metacharacters to run as separate commands. Because the SMM/SMM2 and FPC operate outside the host operating system, code execution on these controllers is not visible to workload-level endpoint tooling and can persist across host reinstalls.

Root Cause

The root cause is improper neutralization of special elements used in an OS command [CWE-78]. Input received through the administrative interface reaches a shell-invoking API (for example, a system() or popen() style call) without allow-listing or argument-vector execution. Shell metacharacters such as ;, |, &&, and backticks are interpreted by the shell rather than treated as literal data.

Attack Vector

Exploitation requires network access to the management interface and valid credentials with elevated privileges. The attacker authenticates to the SMM/SMM2 or FPC web or CLI interface, then submits a crafted parameter to the vulnerable administrative function. The injected payload runs with the privileges of the management service, which typically maps to root on the embedded controller. No user interaction is required, and the scope remains unchanged, but the impact on confidentiality, integrity, and availability of the management controller is complete.

No verified proof-of-concept is publicly available. Refer to Lenovo
Security Advisory LEN-140420 for vendor-supplied technical details.

Detection Methods for CVE-2024-2659

Indicators of Compromise

• Unexpected shell processes (sh, bash, busybox) spawned from the SMM/SMM2 or FPC management daemon in controller logs.
• Administrative audit entries showing invocation of the vulnerable function with parameters containing shell metacharacters such as ;, |, &, $(), or backticks.
• Outbound network connections initiated by the management controller to unfamiliar hosts, which are atypical for baseboard management traffic.

Detection Strategies

• Forward SMM/SMM2 and FPC syslog and audit events to a centralized SIEM and alert on command-line arguments that include shell metacharacters within administrative API calls.
• Baseline normal administrative activity on the management controller and flag deviations, including off-hours logins from unexpected sources and abnormal command frequency.
• Correlate management-plane authentication events with subsequent configuration changes to detect credential misuse leading to injection attempts.

Monitoring Recommendations

• Enable verbose logging on SMM/SMM2 and FPC interfaces and retain logs for at least 90 days to support post-incident review.
• Monitor management-network segments for anomalous egress traffic originating from chassis controllers.
• Track firmware versions across the fleet and alert on any controller running a version listed as vulnerable in Lenovo Security Advisory LEN-140420.

How to Mitigate CVE-2024-2659

Immediate Actions Required

• Apply the fixed SMM/SMM2 and FPC firmware versions identified in Lenovo Security Advisory LEN-140420 to every affected enclosure and node.
• Restrict access to management interfaces to a dedicated out-of-band network reachable only from authorized administrator workstations.
• Rotate all administrator credentials on affected controllers and review recent audit logs for signs of misuse of the vulnerable function.

Patch Information

Lenovo has published fixed firmware for the affected SMM/SMM2 and FPC components. Consult Lenovo Security Advisory LEN-140420 for the exact fixed versions for each enclosure and node model, along with vendor upgrade instructions.

Workarounds

• Enforce least privilege by removing elevated administrative rights from accounts that do not require them, since exploitation requires an authenticated privileged session.
• Place management interfaces behind a jump host and require multi-factor authentication for administrator access to reduce credential-theft risk.
• Disable or limit access to the affected administrative function where operationally acceptable until the firmware update is applied.

# Example: restrict SMM/FPC management access to a dedicated admin subnet
# (adapt to the firewall or ACL platform in use)
iptables -A INPUT -p tcp -s 10.10.50.0/24 --dport 443 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP
iptables -A INPUT -p tcp --dport 22  -j DROP