Critical severity9.8NVD Advisory· Published Apr 22, 2022· Updated Jun 17, 2026

CVE-2021-3849

Description

An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected.

Affected products

Lenovo/System Management Modulellm-fuzzy2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: various
Lenovo/Fan Power Controller2 (FPC2)llm-fuzzy2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: various

Patches

Vulnerability mechanics

References

support.lenovo.com/us/en/product_security/LEN-72615nvdVendor Advisory

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000