CVE-2021-3615 - Vulnerability Details - OpenCVE

A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow code execution if a specific file exists on the attached SD card. This vulnerability is the same as CNVD-2021-45262.

No CVSS v4.0

Attack Vector Physical

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

Access Vector Local

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Lenovo	Smart Camera C2e Smart Camera C2e Firmware Smart Camera X3 Smart Camera X3 Firmware Smart Camera X5 Smart Camera X5 Firmware

Configuration 1 [-]

AND

cpe:2.3:o:lenovo:smart_camera_c2e_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:lenovo:smart_camera_c2e:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:lenovo:smart_camera_x3_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:lenovo:smart_camera_x3:-:*:*:*:*:*:*:*

Configuration 3 [-]

AND

cpe:2.3:o:lenovo:smart_camera_x5_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:lenovo:smart_camera_x5:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://iknow.lenovo.com.cn/detail/dc_198417.html
https://www.cnvd.org.cn/flaw/show/CNVD-2021-45262

History

No history.

MITRE

Status: PUBLISHED

Assigner: lenovo

Published: 2021-08-17T16:25:25

Updated: 2024-08-03T17:01:07.341Z

Reserved: 2021-06-23T00:00:00

Link: CVE-2021-3615

Vulnrichment

No data.

NVD

Status : Modified

Published: 2021-08-17T17:15:07.453

Modified: 2024-11-21T06:21:59.277

Link: CVE-2021-3615

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Smart Camera X3, X5, and C2E firmware", "vendor": "Lenovo", "versions": [{"lessThan": "01.03.29.16", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": " Lenovo thanks Charles Jiang and Xingcan Chen from Lenovo Global Security Lab for reporting these issues."}], "descriptions": [{"lang": "en", "value": "A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow code execution if a specific file exists on the attached SD card. This vulnerability is the same as CNVD-2021-45262."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "description": "CWE-94 Improper Control of Generation of Code ('Code Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2021-08-17T16:25:25", "orgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "shortName": "lenovo"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://iknow.lenovo.com.cn/detail/dc_198417.html"}, {"tags": ["x_refsource_MISC"], "url": "https://www.cnvd.org.cn/flaw/show/CNVD-2021-45262"}], "solutions": [{"lang": "en", "value": "Update to Lenovo Smart Camera X3, X5, and C2E firmware version 01.03.29.16 or later."}], "source": {"advisory": "LEN-49262", "discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "psirt@lenovo.com", "ID": "CVE-2021-3615", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Smart Camera X3, X5, and C2E firmware", "version": {"version_data": [{"version_affected": "<", "version_value": "01.03.29.16"}]}}]}, "vendor_name": "Lenovo"}]}}, "credit": [{"lang": "eng", "value": " Lenovo thanks Charles Jiang and Xingcan Chen from Lenovo Global Security Lab for reporting these issues."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow code execution if a specific file exists on the attached SD card. This vulnerability is the same as CNVD-2021-45262."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-94 Improper Control of Generation of Code ('Code Injection')"}]}]}, "references": {"reference_data": [{"name": "https://iknow.lenovo.com.cn/detail/dc_198417.html", "refsource": "MISC", "url": "https://iknow.lenovo.com.cn/detail/dc_198417.html"}, {"name": "https://www.cnvd.org.cn/flaw/show/CNVD-2021-45262", "refsource": "MISC", "url": "https://www.cnvd.org.cn/flaw/show/CNVD-2021-45262"}]}, "solution": [{"lang": "en", "value": "Update to Lenovo Smart Camera X3, X5, and C2E firmware version 01.03.29.16 or later."}], "source": {"advisory": "LEN-49262", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T17:01:07.341Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://iknow.lenovo.com.cn/detail/dc_198417.html"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.cnvd.org.cn/flaw/show/CNVD-2021-45262"}]}]}, "cveMetadata": {"assignerOrgId": "da227ddf-6e25-4b41-b023-0f976dcaca4b", "assignerShortName": "lenovo", "cveId": "CVE-2021-3615", "datePublished": "2021-08-17T16:25:25", "dateReserved": "2021-06-23T00:00:00", "dateUpdated": "2024-08-03T17:01:07.341Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:smart_camera_c2e_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "340BB3AC-CA35-4967-B2EB-CCA01F6A02C4", "versionEndExcluding": "01.03.29.16", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:smart_camera_c2e:-:*:*:*:*:*:*:*", "matchCriteriaId": "E5514C8B-000F-4393-9039-91BD16C6533D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:smart_camera_x3_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "6C0E7AFD-5D18-4B29-BDC6-8077E74A58D7", "versionEndExcluding": "01.03.29.16", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:smart_camera_x3:-:*:*:*:*:*:*:*", "matchCriteriaId": "DEB64CB7-C439-4C5D-A8B7-35C1D4ECCED0", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:lenovo:smart_camera_x5_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "4104DA2D-A23E-42DE-B87B-0D664EE913B0", "versionEndExcluding": "01.03.29.16", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:lenovo:smart_camera_x5:-:*:*:*:*:*:*:*", "matchCriteriaId": "A5171D89-D3C7-45D3-BFB1-0106CE3E18DD", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow code execution if a specific file exists on the attached SD card. This vulnerability is the same as CNVD-2021-45262."}, {"lang": "es", "value": "Se ha reportado una vulnerabilidad en Lenovo Smart Camera X3, X5 y C2E, que podr\u00eda permitir una ejecuci\u00f3n de c\u00f3digo si presenta un archivo espec\u00edfico en la tarjeta SD conectada. Esta vulnerabilidad es la misma que CNVD-2021-45262."}], "id": "CVE-2021-3615", "lastModified": "2024-11-21T06:21:59.277", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 3.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.7, "impactScore": 5.9, "source": "psirt@lenovo.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "PHYSICAL", "availabilityImpact": "HIGH", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 0.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-08-17T17:15:07.453", "references": [{"source": "psirt@lenovo.com", "tags": ["Vendor Advisory"], "url": "https://iknow.lenovo.com.cn/detail/dc_198417.html"}, {"source": "psirt@lenovo.com", "tags": ["Not Applicable"], "url": "https://www.cnvd.org.cn/flaw/show/CNVD-2021-45262"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://iknow.lenovo.com.cn/detail/dc_198417.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Not Applicable"], "url": "https://www.cnvd.org.cn/flaw/show/CNVD-2021-45262"}], "sourceIdentifier": "psirt@lenovo.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "psirt@lenovo.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}