CVE-2021-3849: An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM)…

PriorityP265critical9.8CVSS 3.1

AVNACLPRNUINSUCHIHAH

EPSS

1.22%

64.8th percentile

An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected.

Affected

7 ranges

Vendor	Product	Version range	Fixed in
ibm	nextscale_fan_power_controller_firmware	< 44a-3.70	44a-3.70
lenovo	fan_power_controller2	—	—
lenovo	lenovo_system_management_module	—	—
lenovo	nextscale_n1200_enclosure_firmware	< fhet50b-2.90	fhet50b-2.90
lenovo	thinkagile_hx_enclosure_certified_node_firmware	< tesm28b-1.21	tesm28b-1.21
lenovo	thinkagile_vx_enclosure_firmware	< tesm28b-1.21	tesm28b-1.21
lenovo	thinksystem_d2_enclosure_firmware	< tesm28b-1.21	tesm28b-1.21

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.