CVE-2021-3849criticalCWE-288

CVE-2021-3849: critical vulnerability in Lenovo Fan Power Controller2 (FPC2)

Published · Updated

Follow this CVE+ Monitor System Management Module+ Monitor Fan Power Controller2

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 1.3%
An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Lenovo · Fan Power Controller2 (FPC2)Lenovo · Lenovo System Management Module (SMM)
Related CVEs — Lenovo Fan Power Controller2 (FPC2)

In the same product, most dangerous first.

CVE-2021-3897CRITICALCVE-2021-3897EPSS 1.3%