CVE-2021-3473

4.5 MEDIUM

An internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/restore password may ...

Published: 2021-04-13 · Last updated: 2026-06-17

Severity and scoring

CVSS: 4.5 MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N
CWE: CWE-312, CWE-319

Affected products

Vendor	Product
lenovo	xclarity_controller

Description

An internal product security audit of Lenovo XClarity Controller (XCC) discovered that the XCC configuration backup/restore password may be written to an internal XCC log buffer if Lenovo XClarity Administrator (LXCA) is used to perform the backup/restore. The backup/restore password typically exists in this internal log buffer for less than 10 minutes before being overwritten. Generating an FFDC service log will include the log buffer contents, including the backup/restore password if present. The FFDC service log is only generated when requested by a privileged XCC user and it is only accessible to the privileged XCC user that requested the file. The backup/restore password is not captured if the backup/restore is initiated directly from XCC.

Source: NVD

References

[NVD]https://nvd.nist.gov/vuln/detail/CVE-2021-3473
[Vendor advisory]https://support.lenovo.com/us/en/product_security/LEN-52117
[Vendor advisory]https://support.lenovo.com/us/en/product_security/LEN-52117

Related CVEs

Same vendor

CVE-2025-13454 — A potential vulnerability was reported in ThinkPlus configuration software that could allow a local authenticated user to gain access to ... (5.5 MEDIUM)
CVE-2025-13453 — A potential vulnerability was reported in some ThinkPlus USB drives that could allow a user with physical access to read data stored on t... (4.6 MEDIUM)
CVE-2022-0354 — A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute ... (7.3 HIGH)
CVE-2021-3633 — A DLL preloading vulnerability was reported in Lenovo Driver Management prior to version 2.9.0719.1104 that could allow privilege escalation (7.3 HIGH)
CVE-2021-3617 — A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow command injection by setting a specially crafted net... (7.2 HIGH)

Same CWE

CVE-2026-46622 — SolidInvoice is an open-source invoicing platform (8.1 HIGH)
CVE-2026-9741 — A bug in query analysis processing of the $vectorSearch aggregation stage for Queryable Encryption (QE) or Client-Side Field Level Encryp... (6.5 MEDIUM)
CVE-2026-10786 — Improper access control in the ticketing integration settings in Devolutions Server allows an authenticated low-privileged user to obtain... (6.5 MEDIUM)
CVE-2026-36176 — GNCC GP5 v7.1.76 was discovered to store pre-signed Backblaze B2 upload URLs (PUT requests) in plaintext to the serial console (7.1 HIGH)
CVE-2026-45432 — This vulnerability exists in GX Earth ONT models due to the transmission of user credentials in plaintext over HTTP in its web management...