CVE-2021-3897
Critical
Description
An authentication bypass vulnerability was discovered in an internal service of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware during an that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected.
SeverityCritical
CVSS9.8
Exploit probability—
Product
Lenovo Nextscale N1200 Enclosure Firmware
PublishedApr 22, 2022
First seenApr 22, 2022
Weakness typeCWE-288CWE-288
How to fix
Update
- lenovo nextscale_n1200_enclosure_firmwarefhet50b-2.90 or later
- lenovo thinkagile_hx_enclosure_certified_node_firmwaretesm28b-1.21 or later
- lenovo thinkagile_vx_enclosure_firmwaretesm28b-1.21 or later
- lenovo thinksystem_d2_enclosure_firmwaretesm28b-1.21 or later
- ibm nextscale_fan_power_controller_firmware44a-3.70 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lenovo nextscale_n1200_enclosure_firmware | v < fhet50b-2.90 | fhet50b-2.90 |
| lenovo thinkagile_hx_enclosure_certified_node_firmware | v < tesm28b-1.21 | tesm28b-1.21 |
| lenovo thinkagile_vx_enclosure_firmware | v < tesm28b-1.21 | tesm28b-1.21 |
| lenovo thinksystem_d2_enclosure_firmware | v < tesm28b-1.21 | tesm28b-1.21 |
| ibm nextscale_fan_power_controller_firmware | v < 44a-3.70 | 44a-3.70 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.