critical9.8
CVE-2021-3897
An authentication bypass vulnerability was discovered in an internal service of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SM…
Impact
An authentication bypass vulnerability was discovered in an internal service of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware during an that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lenovo | Nextscale N1200 Enclosure Firmware | before fhet50b-2.90 |
| Lenovo | Thinkagile Hx Enclosure Certified Node Firmware | before tesm28b-1.21 |
| Lenovo | Thinkagile Vx Enclosure Firmware | before tesm28b-1.21 |
| Lenovo | Thinksystem D2 Enclosure Firmware | before tesm28b-1.21 |
| Ibm | Nextscale Fan Power Controller Firmware | before 44a-3.70 |