CVE-2021-3849: IBM Nextscale Fan Power Controller Firmware

Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days.

An authentication bypass vulnerability was discovered in the web interface of the Lenovo Fan Power Controller2 (FPC2) and Lenovo System Management Module (SMM) firmware that could allow an unauthenticated attacker to execute commands on the SMM and FPC2. SMM2 is not affected.

Affected products

• IBM Nextscale Fan Power Controller Firmware: before 44a-3.70 (fixed in 44a-3.70)
• Lenovo Nextscale n1200 Enclosure Firmware: before fhet50b-2.90 (fixed in fhet50b-2.90)
• Lenovo Thinkagile HX Enclosure Certified Node Firmware: before tesm28b-1.21 (fixed in tesm28b-1.21)
• Lenovo Thinkagile Vx Enclosure Firmware: before tesm28b-1.21 (fixed in tesm28b-1.21)
• Lenovo Thinksystem d2 Enclosure Firmware: before tesm28b-1.21 (fixed in tesm28b-1.21)

Published 2022-04-22. Last modified 2026-06-17.