VulnerabilityModified
CVE-2021-4212
A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook models may allow an attacker with local access and elevated privileges to execute arbitrary code.
MEDIUM 6.7EPSS 0.26%
Does this matter?
Lower severity and a low EPSS score (0.26%). Track it; it rarely justifies an emergency change on its own.
Description
A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook models may allow an attacker with local access and elevated privileges to execute arbitrary code.
- CVSS 3.1
- 6.7 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.26% probability · 18th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- lenovo/c340-14iml firmware · lenovo/c340-15iml firmware · lenovo/d330-10igm firmware · lenovo/duet 3-10igl5 firmware · lenovo/e41-50 firmware · lenovo/flex-14iml firmware · lenovo/flex-15iml firmware · lenovo/ideapad 3-14are05 firmware · lenovo/ideapad 3-15are05 firmware · lenovo/ideapad 3-17are05 firmware · lenovo/ideapad 5-14alc05 firmware · lenovo/ideapad 5-14are05 firmware · lenovo/ideapad 5-15itl05 firmware · lenovo/ideapad 5 pro-14acn6 firmware · lenovo/ideapad 5 pro-14itl6 firmware · lenovo/ideapad 5 pro-16ihu6 firmware · lenovo/ideapad creator 5-15imh05 firmware · lenovo/ideapad gaming 3-15ach6 firmware · lenovo/ideapad gaming 3-15arh05 firmware · lenovo/ideapad gaming 3-15imh05 firmware · +40 more
- Source
- psirt@lenovo.com
References
- https://support.lenovo.com/us/en/product_security/LEN-77639Patch, Vendor Advisory
- https://support.lenovo.com/us/en/product_security/LEN-77639Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.