The ThinkServer System Manager (TSM) Baseboard Management Controller before firmware 1.27.73476 for ThinkServer RD350 RD450 RD550 RD650 and TD350 does not validate server certificates during an \encrypted remote KVM session \ which allows man-in-the-middle attackers to spoof servers.