PT-2021-21154 · Lenovo · Lenovo Smart Camera

Charles Jiang + 1 · Published 2021-08-17 · Updated 2021-08-30 · CVE-2021-3617

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lenovo Smart Camera versions X3, X5, and C2E

Description A vulnerability was reported that could allow command injection by setting a specially crafted network configuration.

Recommendations For Lenovo Smart Camera X3, consider setting a secure network configuration to prevent command injection. For Lenovo Smart Camera X5, consider setting a secure network configuration to prevent command injection. For Lenovo Smart Camera C2E, consider setting a secure network configuration to prevent command injection. As a temporary workaround, consider restricting network configuration changes until a patch is available.

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2021-3617

Affected Products

Lenovo Smart Camera

References · 6

• https://osv.dev/vulnerability/CVE-2021-3617 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-3617 · Security Note
• https://iknow.lenovo.com.cn/detail/dc_198417.html · Vendor Advisory
• https://t.me/cibsecurity/27439 · Telegram Post
• https://cnvd.org.cn/flaw/show/CNVD-2020-68652 · Note
• https://t.me/cvenotify/20371 · Telegram Post