VulnerabilityModified
CVE-2021-3972
A potential vulnerability by a driver used during manufacturing process on some consumer Lenovo Notebook devices' BIOS that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM…
MEDIUM 6.7EPSS 3.00%
Does this matter?
Lower severity and a low EPSS score (3.00%). Track it; it rarely justifies an emergency change on its own.
Description
A potential vulnerability by a driver used during manufacturing process on some consumer Lenovo Notebook devices' BIOS that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
- CVSS 3.1
- 6.7 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 3.00% probability · 87th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-489
- Affected
- lenovo/ideapad 3-14ada05 firmware · lenovo/ideapad 3-14ada6 firmware · lenovo/ideapad 3-14alc6 firmware · lenovo/ideapad 3-14are05 firmware · lenovo/ideapad 3-15ada6 firmware · lenovo/ideapad 3-15alc6 firmware · lenovo/ideapad 3-15are05 firmware · lenovo/ideapad 3-15igl05 firmware · lenovo/ideapad 3-17ada05 firmware · lenovo/ideapad 3-17ada6 firmware · lenovo/ideapad 3-17alc6 firmware · lenovo/ideapad 3-17are05 firmware · lenovo/ideapad 3-17iil05 firmware · lenovo/ideapad 3-17itl6 firmware · lenovo/ideapad 3-15ada05 firmware · lenovo/l3 15iml05 firmware · lenovo/l3-15itl6 firmware · lenovo/l340-15irh firmware · lenovo/l340-15iwl firmware · lenovo/l340-15iwl touch firmware · +40 more
- Source
- psirt@lenovo.com
References
- https://support.lenovo.com/us/en/product_security/LEN-73440Vendor Advisory
- https://support.lenovo.com/us/en/product_security/LEN-73440Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.