PT-2022-10823 · Lenovo · Lenovo System Management Module+1

Published 2022-04-22 · Updated 2022-08-09 · CVE-2021-3897

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware (affected versions not specified) SMM2 is not affected.

Description An authentication bypass issue was discovered in an internal service of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware. This could allow an unauthenticated attacker to execute commands on the SMM and FPC2.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2021-3897

Affected Products

Lenovo Fan Power Controller2

Lenovo System Management Module

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-3897 · Security Note
• https://support.lenovo.com/us/en/product_security/LEN-72615 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-3897 · Vendor Advisory
• https://t.me/cibsecurity/41360 · Telegram Post