CVE-2021-3849

An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected.

Score

CVSS 3.1 9.8 Critical

Status

Modified - psirt@lenovo.com

Published

2022-04-22

Last modified

2024-08-03

Weaknesses

CWE-288

Affected products

• Nextscale Fan Power Controller Firmware (Ibm)
• Fan Power Controller2 Fpc2 (Lenovo)
• Lenovo System Management Module Smm (Lenovo)
• Nextscale N1200 Enclosure Firmware (Lenovo)
• Thinkagile Hx Enclosure Certified Node Firmware (Lenovo)
• Thinkagile Vx Enclosure Firmware (Lenovo)
• Thinksystem D2 Enclosure Firmware (Lenovo)

References

• https://support.lenovo.com/us/en/product_security/LEN-72615