Medium severity · published Apr 22, 2022
CVE-2021-4210
A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access…
6.7
CVSS
0.3%
EPSS
No
On KEV
Description
A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 18% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
A540-24icb Firmware · Lenovo
All versions, or not specified · source: NVD
AF
A540-27icb Firmware · Lenovo
All versions, or not specified · source: NVD
I5
Ideacentre 5-14imb05 Firmware · Lenovo
All versions, or not specified · source: NVD
IA
Ideacentre Aio 3-22ada6 Firmware · Lenovo
All versions, or not specified · source: NVD
IA
Ideacentre Aio 3-22iil5 Firmware · Lenovo
All versions, or not specified · source: NVD
IA
Ideacentre Aio 3-22itl6 Firmware · Lenovo
All versions, or not specified · source: NVD
IA
Ideacentre Aio 3-24ada6 Firmware · Lenovo
All versions, or not specified · source: NVD
IA
Ideacentre Aio 3-24iil5 Firmware · Lenovo
All versions, or not specified · source: NVD
IA
Ideacentre Aio 3-24itl6 Firmware · Lenovo
All versions, or not specified · source: NVD
IA
Ideacentre Aio 3-27itl6 Firmware · Lenovo
All versions, or not specified · source: NVD
IC
Ideacentre C5-14imb05 Firmware · Lenovo
All versions, or not specified · source: NVD
IG
Ideacentre G5-14imb05 Firmware · Lenovo
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-4210
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-4210
Patch
https://support.lenovo.com/us/en/product_security/LEN-77639
More from A540-24icb Firmware
6.7
CVE-2021-4211
A potential vulnerability in the SMI callback function used in the SMBIOS event log driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with…