CVE-2021-3849

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-04-22 · updated 2026-06-17
Weakness: CWE-288

Description

An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected.

Affected products

IBM Nextscale Fan Power Controller Firmware: before 44a-3.70 — fixed in 44a-3.70
Lenovo Nextscale N1200 Enclosure Firmware: before fhet50b-2.90 — fixed in fhet50b-2.90
Lenovo Thinkagile Hx Enclosure Certified Node Firmware: before tesm28b-1.21 — fixed in tesm28b-1.21
Lenovo Thinkagile Vx Enclosure Firmware: before tesm28b-1.21 — fixed in tesm28b-1.21
Lenovo Thinksystem D2 Enclosure Firmware: before tesm28b-1.21 — fixed in tesm28b-1.21

How to fix

Upgrade to a fixed version: IBM Nextscale Fan Power Controller Firmware 44a-3.70; Lenovo Nextscale N1200 Enclosure Firmware fhet50b-2.90; Lenovo Thinkagile Hx Enclosure Certified Node Firmware tesm28b-1.21; Lenovo Thinkagile Vx Enclosure Firmware tesm28b-1.21; Lenovo Thinksystem D2 Enclosure Firmware tesm28b-1.21. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-3849 or the next vulnerability affects your stack