Medium severity · published Jul 16, 2021
CVE-2021-3453
Some Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could allow an attacker with physical access the ability to write…
4.6
CVSS
0.2%
EPSS
No
On KEV
Description
Some Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could allow an attacker with physical access the ability to write to the SPI flash storage.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 15% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
BI
BIOS · Lenovo
various · source: vendor
7F
730s-13iml Firmware · Lenovo
All versions, or not specified · source: NVD
IA
Ideacentre Aio 5-24imb05 Firmware · Lenovo
before 2021-09-30 · source: NVD
IA
Ideacentre Aio 5-74imb05 Firmware · Lenovo
before 2021-09-30 · source: NVD
I1
Ideapad 1-11igl05 Firmware · Lenovo
All versions, or not specified · source: NVD
I1
Ideapad 1-14igl05 Firmware · Lenovo
All versions, or not specified · source: NVD
IS
Ideapad S940-14iil Firmware · Lenovo
All versions, or not specified · source: NVD
IS
Ideapad S940-14iwl Firmware · Lenovo
All versions, or not specified · source: NVD
IS
Ideapad Slim 1-11ast-05 Firmware · Lenovo
All versions, or not specified · source: NVD
IS
Ideapad Slim 1-14ast-05 Firmware · Lenovo
All versions, or not specified · source: NVD
TH
Thinkpad Helix Firmware · Lenovo
n17etb4w · source: NVD
TT
Thinkpad T550 Firmware · Lenovo
n11et53w · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-3453
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-3453
Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-65529
More from BIOS
7.8
CVE-2022-3431
A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with…
7.8
CVE-2022-1892
A buffer overflow in the SystemBootManagerDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code
7.8
CVE-2022-1891
A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code
7.8
CVE-2022-1890
A buffer overflow in the ReadyBootDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code
7.8
CVE-2016-5247
The BIOS for Lenovo ThinkCentre E93, M6500t/s, M6600, M6600q, M6600t/s, M73p, M800, M83, M8500t/s, M8600t/s, M900, M93, and M93P devices; ThinkServer RQ940, RS140, TS140, TS240,…