CVE-2021-3473

CVE-2021-3473 describes a vulnerability in Lenovo XClarity Controller (XCC) where the configuration backup/restore password may be temporarily written to an internal XCC log buffer if the operation is initiated via Lenovo XClarity Administrator (LXCA). This sensitive information, present for less than 10 minutes, could then be included in an FFDC service log generated by a privileged XCC user. The vulnerability has a CVSS score of 4.9 (Medium) with an attack vector of Network and high confidentiality impact, but requires high privileges (PR:H) and no user interaction. While an attacker could potentially gain access to the backup/restore password, this requires an already privileged XCC user to generate and access the FFDC log. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage regarding this CVE. Its EPSS score is very low, indicating a minimal likelihood of exploitation.