Improper input validation in Lenovo Thinkcentre And Thinkstation Bios
CVE-2021-3719
A potential vulnerability in the SMI callback function that saves and restore boot script tables used for resuming from sleep state in some ThinkCentre and ThinkStation models may allow an attacker with local access and elevated privileges to execute arbitrary code.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.003 (16.5th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 17th percentile — 16.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Lenovo Thinkcentre And Thinkstation Bios — versions various
- Lenovo Thinkcentre E93
- Lenovo Thinkcentre E93 Firmware
- Lenovo Thinkcentre M4500q
- Lenovo Thinkcentre M4500q Firmware
- Lenovo Thinkcentre M600
- Lenovo Thinkcentre M600 Firmware
- Lenovo Thinkcentre M6500t\/s
- Lenovo Thinkcentre M6500t\/s Firmware
- Lenovo Thinkcentre M700 Tiny
Weakness classification (CWE)
References
- support.lenovo.com/us/en/product_security/LEN-67440 (Vendor Advisory)
Frequently asked questions
- What is CVE-2021-3719?
- CVE-2021-3719 is a medium-severity vulnerability in Lenovo Thinkcentre And Thinkstation Bios, classified under Improper Input Validation. CVSS score: 6.7/10. Published 2021-11-12.
- How severe is CVE-2021-3719?
- Medium severity. CVSS v3 base score is 6.7 out of 10.