CVE-2021-3617 - OpenCVE

A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow command injection by setting a specially crafted network configuration. This vulnerability is the same as CNVD-2020-68652.

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:S/C:P/I:P/A:P

Vendors & Products
CPE Configurations

Vendors	Products
Lenovo	Smart Camera X3 Firmware Smart Camera X5 Smart Camera X5 Firmware Smart Camera C2e Smart Camera X3 Smart Camera C2e Firmware

Configuration 1 [-]

AND

cpe:2.3:o:lenovo:smart_camera_c2e_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:lenovo:smart_camera_c2e:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:lenovo:smart_camera_x3_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:lenovo:smart_camera_x3:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:lenovo:smart_camera_x5_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:lenovo:smart_camera_x5:-:*:*:*:*:*:*:*

References

Link	Resource
https://iknow.lenovo.com.cn/detail/dc_198417.html	Vendor Advisory
https://www.cnvd.org.cn/flaw/show/CNVD-2020-68652	Not Applicable

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: lenovo

Published: 2021-08-17T16:25:29

Updated: 2021-08-17T16:25:29

Reserved: 2021-06-23T00:00:00

Link: CVE-2021-3617

JSON object: View

NVD Information

Status : Analyzed

Published: 2021-08-17T17:15:07.610

Modified: 2021-08-30T18:41:44.507

Link: CVE-2021-3617

JSON object: View

Redhat Information

No data.

CWE

{"containers": {"cna": {"affected": [{"product": "Smart Camera X3, X5, and C2E firmware", "vendor": "Lenovo", "versions": [{"lessThan": "01.03.29.16", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": " Lenovo thanks Charles Jiang and Xingcan Chen from Lenovo Global Security Lab for reporting these issues."}], "descriptions": [{"lang": "en", "value": "A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow command injection by setting a specially crafted network configuration. This vulnerability is the same as CNVD-2020-68652."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "description": "CWE-78 OS Command Injection", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-08-17T16:25:29", "orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "shortName": "lenovo"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://iknow.lenovo.com.cn/detail/dc_198417.html"}, {"tags": ["x_refsource_MISC"], "url": "https://www.cnvd.org.cn/flaw/show/CNVD-2020-68652"}], "solutions": [{"lang": "en", "value": "Update to Lenovo Smart Camera X3, X5, and C2E firmware version 01.03.29.16 or later."}], "source": {"advisory": "LEN-49262", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@lenovo.com", "ID": "CVE-2021-3617", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Smart Camera X3, X5, and C2E firmware", "version": {"version_data": [{"version_affected": "<", "version_value": "01.03.29.16"}]}}]}, "vendor_name": "Lenovo"}]}}, "credit": [{"lang": "eng", "value": " Lenovo thanks Charles Jiang and Xingcan Chen from Lenovo Global Security Lab for reporting these issues."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow command injection by setting a specially crafted network configuration. This vulnerability is the same as CNVD-2020-68652."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-78 OS Command Injection"}]}]}, "references": {"reference_data": [{"name": "https://iknow.lenovo.com.cn/detail/dc_198417.html", "refsource": "MISC", "url": "https://iknow.lenovo.com.cn/detail/dc_198417.html"}, {"name": "https://www.cnvd.org.cn/flaw/show/CNVD-2020-68652", "refsource": "MISC", "url": "https://www.cnvd.org.cn/flaw/show/CNVD-2020-68652"}]}, "solution": [{"lang": "en", "value": "Update to Lenovo Smart Camera X3, X5, and C2E firmware version 01.03.29.16 or later."}], "source": {"advisory": "LEN-49262", "discovery": "UNKNOWN"}}}}, "cveMetadata": {"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "assignerShortName": "lenovo", "cveId": "CVE-2021-3617", "datePublished": "2021-08-17T16:25:29", "dateReserved": "2021-06-23T00:00:00", "dateUpdated": "2021-08-17T16:25:29", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:smart_camera_c2e_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "340BB3AC-CA35-4967-B2EB-CCA01F6A02C4", "versionEndExcluding": "01.03.29.16", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:smart_camera_c2e:-:*:*:*:*:*:*:*", "matchCriteriaId": "E5514C8B-000F-4393-9039-91BD16C6533D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:smart_camera_x3_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "6C0E7AFD-5D18-4B29-BDC6-8077E74A58D7", "versionEndExcluding": "01.03.29.16", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:smart_camera_x3:-:*:*:*:*:*:*:*", "matchCriteriaId": "DEB64CB7-C439-4C5D-A8B7-35C1D4ECCED0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:smart_camera_x5_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "4104DA2D-A23E-42DE-B87B-0D664EE913B0", "versionEndExcluding": "01.03.29.16", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:smart_camera_x5:-:*:*:*:*:*:*:*", "matchCriteriaId": "A5171D89-D3C7-45D3-BFB1-0106CE3E18DD", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow command injection by setting a specially crafted network configuration. This vulnerability is the same as CNVD-2020-68652."}, {"lang": "es", "value": "Se ha reportado una vulnerabilidad en Lenovo Smart Camera X3, X5 y C2E, que podr\u00eda permitir una inyecci\u00f3n de comandos al ajustar una configuraci\u00f3n de red especialmente dise\u00f1ada. Esta vulnerabilidad es la misma que CNVD-2020-68652."}], "id": "CVE-2021-3617", "lastModified": "2021-08-30T18:41:44.507", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "psirt@lenovo.com", "type": "Secondary"}]}, "published": "2021-08-17T17:15:07.610", "references": [{"source": "psirt@lenovo.com", "tags": ["Vendor Advisory"], "url": "https://iknow.lenovo.com.cn/detail/dc_198417.html"}, {"source": "psirt@lenovo.com", "tags": ["Not Applicable"], "url": "https://www.cnvd.org.cn/flaw/show/CNVD-2020-68652"}], "sourceIdentifier": "psirt@lenovo.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-78"}], "source": "psirt@lenovo.com", "type": "Secondary"}]}