CVE-2021-3616 - OpenCVE

A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow an unauthorized user to view device information, alter firmware content and device configuration. This vulnerability is the same as CNVD-2020-68651.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:N/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Lenovo	Smart Camera C2e Smart Camera C2e Firmware Smart Camera X3 Smart Camera X3 Firmware Smart Camera X5 Smart Camera X5 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:lenovo:smart_camera_c2e_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:lenovo:smart_camera_c2e:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:lenovo:smart_camera_x3_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:lenovo:smart_camera_x3:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:lenovo:smart_camera_x5_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:lenovo:smart_camera_x5:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://iknow.lenovo.com.cn/detail/dc_198417.html
https://www.cnvd.org.cn/flaw/show/CNVD-2020-68651

History

No history.

MITRE

Status: PUBLISHED

Assigner: lenovo

Published: 2021-08-17T16:25:27

Updated: 2024-08-03T17:01:07.695Z

Reserved: 2021-06-23T00:00:00

Link: CVE-2021-3616

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2021-08-17T17:15:07.533

Modified: 2021-08-30T18:31:32.030

Link: CVE-2021-3616

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Smart Camera X3, X5, and C2E firmware", "vendor": "Lenovo", "versions": [{"lessThan": "01.03.29.16", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": " Lenovo thanks Charles Jiang and Xingcan Chen from Lenovo Global Security Lab for reporting these issues."}], "descriptions": [{"lang": "en", "value": "A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow an unauthorized user to view device information, alter firmware content and device configuration. This vulnerability is the same as CNVD-2020-68651."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-285", "description": "CWE-285 Improper Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-08-17T16:25:27", "orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "shortName": "lenovo"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://iknow.lenovo.com.cn/detail/dc_198417.html"}, {"tags": ["x_refsource_MISC"], "url": "https://www.cnvd.org.cn/flaw/show/CNVD-2020-68651"}], "solutions": [{"lang": "en", "value": "Update to Lenovo Smart Camera X3, X5, and C2E firmware version 01.03.29.16 or later."}], "source": {"advisory": "LEN-49262", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@lenovo.com", "ID": "CVE-2021-3616", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Smart Camera X3, X5, and C2E firmware", "version": {"version_data": [{"version_affected": "<", "version_value": "01.03.29.16"}]}}]}, "vendor_name": "Lenovo"}]}}, "credit": [{"lang": "eng", "value": " Lenovo thanks Charles Jiang and Xingcan Chen from Lenovo Global Security Lab for reporting these issues."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow an unauthorized user to view device information, alter firmware content and device configuration. This vulnerability is the same as CNVD-2020-68651."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-285 Improper Authorization"}]}]}, "references": {"reference_data": [{"name": "https://iknow.lenovo.com.cn/detail/dc_198417.html", "refsource": "MISC", "url": "https://iknow.lenovo.com.cn/detail/dc_198417.html"}, {"name": "https://www.cnvd.org.cn/flaw/show/CNVD-2020-68651", "refsource": "MISC", "url": "https://www.cnvd.org.cn/flaw/show/CNVD-2020-68651"}]}, "solution": [{"lang": "en", "value": "Update to Lenovo Smart Camera X3, X5, and C2E firmware version 01.03.29.16 or later."}], "source": {"advisory": "LEN-49262", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T17:01:07.695Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://iknow.lenovo.com.cn/detail/dc_198417.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.cnvd.org.cn/flaw/show/CNVD-2020-68651"}]}]}, "cveMetadata": {"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "assignerShortName": "lenovo", "cveId": "CVE-2021-3616", "datePublished": "2021-08-17T16:25:27", "dateReserved": "2021-06-23T00:00:00", "dateUpdated": "2024-08-03T17:01:07.695Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:smart_camera_c2e_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "340BB3AC-CA35-4967-B2EB-CCA01F6A02C4", "versionEndExcluding": "01.03.29.16", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:smart_camera_c2e:-:*:*:*:*:*:*:*", "matchCriteriaId": "E5514C8B-000F-4393-9039-91BD16C6533D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:smart_camera_x3_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "6C0E7AFD-5D18-4B29-BDC6-8077E74A58D7", "versionEndExcluding": "01.03.29.16", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:smart_camera_x3:-:*:*:*:*:*:*:*", "matchCriteriaId": "DEB64CB7-C439-4C5D-A8B7-35C1D4ECCED0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:smart_camera_x5_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "4104DA2D-A23E-42DE-B87B-0D664EE913B0", "versionEndExcluding": "01.03.29.16", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:smart_camera_x5:-:*:*:*:*:*:*:*", "matchCriteriaId": "A5171D89-D3C7-45D3-BFB1-0106CE3E18DD", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow an unauthorized user to view device information, alter firmware content and device configuration. This vulnerability is the same as CNVD-2020-68651."}, {"lang": "es", "value": "Se ha reportado una vulnerabilidad en Lenovo Smart Camera X3, X5 y C2E, que podr\u00eda permitir a un usuario no autorizado visualizar la informaci\u00f3n del dispositivo, alterar el contenido del firmware y la configuraci\u00f3n del dispositivo. Esta vulnerabilidad es la misma que CNVD-2020-68651."}], "id": "CVE-2021-3616", "lastModified": "2021-08-30T18:31:32.030", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.5, "source": "psirt@lenovo.com", "type": "Secondary"}]}, "published": "2021-08-17T17:15:07.533", "references": [{"source": "psirt@lenovo.com", "tags": ["Vendor Advisory"], "url": "https://iknow.lenovo.com.cn/detail/dc_198417.html"}, {"source": "psirt@lenovo.com", "tags": ["Not Applicable"], "url": "https://www.cnvd.org.cn/flaw/show/CNVD-2020-68651"}], "sourceIdentifier": "psirt@lenovo.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-Other"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-285"}], "source": "psirt@lenovo.com", "type": "Secondary"}]}