CVE-2021-3956

Name: CVE-2021-3956
Creator: NVD / NIST
Published: 2022-05-18T16:15:08.063+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 5.3/10EPSS 0.72%

Last modified Jun 17, 2026

CVE-2021-3956 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. A read-only authentication bypass vulnerability was reported in the Third Quarter 2021 release of Lenovo XClarity Controller (XCC) firmware affecting XCC devices configured in LDAP Authentication Only Mode and using an LDAP server that supports “unauthenticated bind”, such as Microsoft Active Directory. An unauthenticated user can gain read-only access to XCC in such a configuration, thereby allowing the XCC device configuration to be viewed but not changed. EPSS estimates a 0.72% chance of exploitation in the next 30 days.

Description

A read-only authentication bypass vulnerability was reported in the Third Quarter 2021 release of Lenovo XClarity Controller (XCC) firmware affecting XCC devices configured in LDAP Authentication Only Mode and using an LDAP server that supports “unauthenticated bind”, such as Microsoft Active Directory. An unauthenticated user can gain read-only access to XCC in such a configuration, thereby allowing the XCC device configuration to be viewed but not changed. XCC devices configured to use local authentication, LDAP Authentication + Authorization Mode, or LDAP servers that support only “authenticated bind” and/or “anonymous bind” are not affected.

Metrics

CVSS 3.1

5.3/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS Probability

0.72%

49.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Lenovo	Xclarity Controller	< 7.22_cdi382o
Lenovo	Xclarity Controller	< 2.32_psi342n
Lenovo	Xclarity Controller	< 3.41_tei382m
Lenovo	Xclarity Controller	< 4.83_tei3c0n
Lenovo	Xclarity Controller	< 1.51_tgbt24l

References

https://support.lenovo.com/us/en/product_security/LEN-72074Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-72074Vendor Advisory

Timeline

Published: May 18, 2022
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2021-3956?

How severe is CVE-2021-3956?

CVE-2021-3956 has a CVSS score of 5.3/10 (MEDIUM severity). The EPSS model estimates a 0.72% probability of exploitation in the next 30 days.

How do I fix CVE-2021-3956?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-3956?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST