CVE-2021-3956: lenovo xclarity controller

csirt@kutim:~/threat-intel/cve/CVE-2021-3956

CVSS 5.3 · Medium EPSS 0,79%

Kerentanan Incorrect Authorization pada lenovo xclarity controller. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

A read-only authentication bypass vulnerability was reported in the Third Quarter 2021 release of Lenovo XClarity Controller (XCC) firmware affecting XCC devices configured in LDAP Authentication Only Mode and using an LDAP server that supports “unauthenticated bind”, such as Microsoft Active Directory. An unauthenticated user can gain read-only access to XCC in such a configuration, thereby allowing the XCC device configuration to be viewed but not changed. XCC devices configured to use local authentication, LDAP Authentication + Authorization Mode, or LDAP servers that support only “authenticated bind” and/or “anonymous bind” are not affected.

Rincian

Terbit di NVD: 18 Mei 2022
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-863: Incorrect Authorization
EPSS (30 hari): 0,79% peluang dieksploitasi; lebih tinggi dari 54,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
lenovo	xclarity controller	Semua versi sebelum 7.22_cdi382o
lenovo	xclarity controller	Semua versi sebelum 2.32_psi342n
lenovo	xclarity controller	Semua versi sebelum 3.41_tei382m
lenovo	xclarity controller	Semua versi sebelum 4.83_tei3c0n
lenovo	xclarity controller	Semua versi sebelum 1.51_tgbt24l

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://support.lenovo.com/us/en/product_security/LEN-72074 advisory vendor

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.