CVE-2021-3849

Name: CVE-2021-3849
Creator: NVD / NIST
Published: 2022-04-22T21:15:09.557+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.8/10EPSS 1.22%

Last modified Jun 17, 2026

CVE-2021-3849 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected.. EPSS estimates a 1.22% chance of exploitation in the next 30 days.

Description

An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

1.22%

64.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-288

Affected Software

Vendor	Product	Versions
Lenovo	Nextscale N1200 Enclosure Firmware	< fhet50b-2.90
Lenovo	Thinkagile Hx Enclosure Certified Node Firmware	< tesm28b-1.21
Lenovo	Thinkagile Vx Enclosure Firmware	< tesm28b-1.21
Lenovo	Thinksystem D2 Enclosure Firmware	< tesm28b-1.21
Ibm	Nextscale Fan Power Controller Firmware	< 44a-3.70

References

https://support.lenovo.com/us/en/product_security/LEN-72615Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-72615Vendor Advisory

Timeline

Published: Apr 22, 2022
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2021-3849?

How severe is CVE-2021-3849?

CVE-2021-3849 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 1.22% probability of exploitation in the next 30 days.

How do I fix CVE-2021-3849?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-3849?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST