Lucene search

[email protected]CVE-2021-3897

HistoryApr 22, 2022 - 9:15 p.m.

CVE-2021-3897

2022-04-2221:15:09

CWE-288

[email protected]

web.nvd.nist.gov

cve-2021-3897

lenovo

fan power controller2

system management module

firmware

authentication bypass

vulnerability

unauthenticated attacker

command execution

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.8%

JSON

An authentication bypass vulnerability was discovered in an internal service of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware during an that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected.

Affected configurations

NVD

Node

lenovonextscale_n1200_enclosure_firmwareRange<fhet50b-2.90

AND

lenovonextscale_n1200_enclosureMatch-

Node

lenovothinkagile_hx_enclosure_certified_node_firmwareRange<tesm28b-1.21

AND

lenovothinkagile_hx_enclosure_certified_nodeMatch-

Node

lenovothinkagile_vx_enclosure_firmwareRange<tesm28b-1.21

AND

lenovothinkagile_vx_enclosureMatch-

Node

lenovothinksystem_d2_enclosure_firmwareRange<tesm28b-1.21

AND

lenovothinksystem_d2_enclosureMatch-

Node

ibmnextscale_fan_power_controller_firmwareRange<44a-3.70

AND

ibmnextscale_fan_power_controllerMatch-

CPENameOperatorVersion
lenovo:nextscale_n1200_enclosure_firmwarelenovo nextscale n1200 enclosure firmwareltfhet50b-2.90

CPE	Name	Operator	Version
lenovo:nextscale_n1200_enclosure_firmware	lenovo nextscale n1200 enclosure firmware	lt	fhet50b-2.90

CNA Affected

[
  {
    "product": "Fan Power Controller2 (FPC2)",
    "vendor": "Lenovo",
    "versions": [
      {
        "status": "affected",
        "version": "various"
      }
    ]
  },
  {
    "product": "Lenovo System Management Module (SMM)",
    "vendor": "Lenovo",
    "versions": [
      {
        "status": "affected",
        "version": "various"
      }
    ]
  }
]

References

support.lenovo.com/us/en/product_security/LEN-72615

Social References

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

53.8%

JSON

Related for CVE-2021-3897

prion1 nvd1 cvelist1