Improper authorization in Lenovo Smart Camera X3, X5, and C2E firmware
Priority MEDIUM 44CWE-285Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-285.
Summary
A vulnerability was reported in Lenovo Smart Camera X3, X5, and C2E that could allow an unauthorized user to view device information, alter firmware content and device configuration. This vulnerability is the same as CNVD-2020-68651.
Why it matters now
EPSS 0.00924 60th percentileScored 2026-11-07
Fix Fixed Smart Camera X3, X5, and C2E firmware (Lenovo): 01.03.29.16
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Lenovo | Smart Camera X3, X5, and C2E firmware | before 01.03.29.16 | 01.03.29.16 | Patch available | CNA |
- Smart Camera X3, X5, and C2E firmware VendorLenovo Affected before 01.03.29.16 Fixed in 01.03.29.16 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:lenovo:smart_camera_c2e_firmware:*:*:*:*:*:*:*:* | before 01.03.29.16 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:smart_camera_c2e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:smart_camera_x3_firmware:*:*:*:*:*:*:*:* | before 01.03.29.16 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:smart_camera_x3:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:smart_camera_x5_firmware:*:*:*:*:*:*:*:* | before 01.03.29.16 | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:smart_camera_x5:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
- cpe:2.3:o:lenovo:smart_camera_c2e_firmware:*:*:*:*:*:*:*:* Versions before 01.03.29.16 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:smart_camera_c2e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:smart_camera_x3_firmware:*:*:*:*:*:*:*:* Versions before 01.03.29.16 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:smart_camera_x3:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:smart_camera_x5_firmware:*:*:*:*:*:*:*:* Versions before 01.03.29.16 Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:smart_camera_x5:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Remediation
- Fix · CNA Smart Camera X3, X5, and C2E firmware (Lenovo) Fixed in 01.03.29.16
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Lenovo Smart Camera X3, X5, and C2E firmware 01.03.29.16
3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2021-02563 OS command injection in Lenovo Smart Camera X3, X5, and C2E firmwarePriority LOW 35
- TI-2021-02561 Code injection in Lenovo Smart Camera X3, X5, and C2E firmwarePriority LOW 30
Timeline
- 2026-10-02 Threatist record created from CVE-2021-3616
- 2026-10-03 Alias added: GHSA-qrw6-qjvm-cr2m
References
More Lenovo Smart Camera C2e Firmware vulnerabilities
- TI-2021-02563 OS command injection in Lenovo Smart Camera X3, X5, and C2E firmware CVSS 3.1HIGH 7.2
- TI-2021-02561 Code injection in Lenovo Smart Camera X3, X5, and C2E firmware CVSS 3.1MEDIUM 6.8
Sources
- CVE-2021-3616 · CVE Program
- CVE-2021-3616 · NVD
- FIRST EPSS
- GHSA-qrw6-qjvm-cr2m · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences