CVE-2021-3473

An internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/restore password may be written to an internal XCC log buffer if Lenovo XClarity Administrator (LXCA) is used to perform the backup/restore. The backup/restore password typically exists in this internal log buffer for less than 10 minutes before being overwritten. Generating an FFDC service log will include the log buffer contents, including the backup/restore password if present. The FFDC service log is only generated when requested by a privileged XCC user and it is only accessible to the privileged XCC user that requested the file. The backup/restore password is not captured if the backup/restore is initiated directly from XCC.

• CWE-319
• CWE-312

• https://support.lenovo.com/us/en/product_security/LEN-52117Vendor Advisory
• https://support.lenovo.com/us/en/product_security/LEN-52117Vendor Advisory

Published

Apr 13, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-34724A vulnerability in the Cisco IOS XE SD-WAN Software CLI coul…6
• CVE-2021-34725A vulnerability in the CLI of Cisco IOS XE SD-WAN Software c…6.7
• CVE-2021-34726A vulnerability in the CLI of Cisco SD-WAN Software could al…6.7
• CVE-2021-34727A vulnerability in the vDaemon process in Cisco IOS XE SD-WA…9.8
• CVE-2021-34728Multiple vulnerabilities in the CLI of Cisco IOS XR Software…7.8
• CVE-2021-34729A vulnerability in the CLI of Cisco IOS XE SD-WAN Software a…6.7
• CVE-2021-34730A vulnerability in the Universal Plug-and-Play (UPnP) servic…9.8
• CVE-2021-34731A vulnerability in the web-based management interface of Cis…4.8
• CVE-2021-34732A vulnerability in the web-based management interface of Cis…6.1
• CVE-2021-34733A vulnerability in the CLI of Cisco Prime Infrastructure and…5.5
• CVE-2021-34734A vulnerability in the Link Layer Discovery Protocol (LLDP) …6.5
• CVE-2021-34735Multiple vulnerabilities in the Cisco ATA 190 Series Analog …7.5