CVE-2021-3849 json
An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Man…
published 2022-04-22 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-27091
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.3%
- EPSS 1.3% chance of exploitation in 30 days, percentile 70%
- public exploits
- 0
- none known
Summary
An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected.
Patch / fix
- lenovo nextscale_n1200_enclosure_firmware fhet50b-2.90
- lenovo thinkagile_hx_enclosure_certified_node_firmware tesm28b-1.21
- lenovo thinkagile_vx_enclosure_firmware tesm28b-1.21
- lenovo thinksystem_d2_enclosure_firmware tesm28b-1.21
- ibm nextscale_fan_power_controller_firmware 44a-3.70
Exploit prediction
1.30% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
Affected products
- Lenovo Fan Power Controller2 (FPC2)
- Lenovo Lenovo System Management Module (SMM)
Classification
- Weakness
-
- CWE-288 Authentication Bypass Using an Alternate Path or Channel
References
-
support.lenovo.com
/us/en/product_security/LEN-72615
vendor-advisory
Sources
- CVE List CVE-2021-3849
- NVD CVE-2021-3849
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.