Critical severity · published Apr 22, 2022
CVE-2021-3849
An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware that could…
9.8
CVSS
1.3%
EPSS
No
On KEV
Description
An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
NF
Nextscale Fan Power Controller Firmware · Ibm
before 44a-3.70 · source: NVD
NN
Nextscale N1200 Enclosure Firmware · Lenovo
before fhet50b-2.90 · source: NVD
TH
Thinkagile HX Enclosure Certified Node Firmware · Lenovo
before tesm28b-1.21 · source: NVD
TV
Thinkagile VX Enclosure Firmware · Lenovo
before tesm28b-1.21 · source: NVD
TD
Thinksystem D2 Enclosure Firmware · Lenovo
before tesm28b-1.21 · source: NVD
Affected product
NF
Nextscale Fan Power Controller Firmware
Ibm
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-3849
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-3849
Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-72615
More from Nextscale Fan Power Controller Firmware
9.8
CVE-2021-3897
An authentication bypass vulnerability was discovered in an internal service of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware during…