Medium severity · published Nov 12, 2021
CVE-2021-3519
A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At Boot Device List" BIOS setting is Yes
6.8
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At Boot Device List" BIOS setting is Yes.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
I3
Ideacentre 3-07imb05 Firmware · Lenovo
before m2vkt18a · source: NVD
I3
Ideacentre 310s-08igm Firmware · Lenovo
through m1tkt31a · source: NVD
I5
Ideacentre 5-14imb05 Firmware · Lenovo
before o4hkt33a · source: NVD
I5
Ideacentre 5-14iob6 Firmware · Lenovo
before m3gkt29a · source: NVD
I5
Ideacentre 510a-15arr Firmware · Lenovo
through o4dkt41a · source: NVD
I5
Ideacentre 510s-07icb Firmware · Lenovo
before m22kt46a · source: NVD
I5
Ideacentre 510s-07ick Firmware · Lenovo
before m30kt24a; before m30kt23a · source: NVD
IC
Ideacentre C5-14mb05 Firmware · Lenovo
before o4hkt33a · source: NVD
IC
Ideacentre Creator 5-14iob6 Firmware · Lenovo
before m3gkt29a · source: NVD
IG
Ideacentre G5-14imb05 Firmware · Lenovo
before o4hkt33a · source: NVD
IG
Ideacentre Gaming 5-14iob6 Firmware · Lenovo
before m3gkt29a · source: NVD
TE
Thinkcentre E75 T/s Firmware · Lenovo
before m16kt67a · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-3519
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-3519
Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-67440
More from Ideacentre 3-07imb05 Firmware
7.8
CVE-2022-48181
An ErrorMessage driver stack-based buffer overflow vulnerability in BIOS of some ThinkPad models could allow an attacker with local access to elevate their privileges and execute…
6.7
CVE-2023-45079
A memory leakage vulnerability was reported in the NvmramSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM variables
6.7
CVE-2023-45078
A memory leakage vulnerability was reported in the DustFilterAlertSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM variables
6.7
CVE-2023-45077
A memory leakage vulnerability was reported in the 534D0740 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables
6.7
CVE-2023-45076
A memory leakage vulnerability was reported in the 534D0140 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables