CVE-2021-3849: Critical severity lenovo nextscale n1200 enclosure vulnerability
An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is CVE-2021-3849?
CVE-2021-3849 is an authentication bypass vulnerability in the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware that allows an unauthenticated attacker to execute commands on the SMM and FPC2.
What software is affected by CVE-2021-3849?
The affected software includes Lenovo Nextscale N1200 Enclosure Firmware, Lenovo Thinkagile Hx Enclosure Certified Node Firmware, Lenovo Thinkagile Vx Enclosure Firmware, and Lenovo Thinksystem D2 Enclosure Firmware.
How severe is CVE-2021-3849?
CVE-2021-3849 has a severity rating of 9.8 (Critical).
How can an attacker exploit CVE-2021-3849?
An attacker can exploit CVE-2021-3849 by bypassing authentication in the web interface and executing commands on the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM).
Where can I find more information about CVE-2021-3849?
You can find more information about CVE-2021-3849 on the Lenovo Product Security website.