Search/CVE-2021-3453
● CVE — Medium

CVE-2021-3453

VendorlenovoProductthinkpad helix firmware, 730s-13iml firmware, ideacentre aio 5-24imb05 firmware, ideacentre aio 5-74imb05 firmware, ideapad 1-11igl05 firmware, ideapad 1-14igl05 firmware, ideapad s940-14iil firmware, ideapad s940-14iwl firmware, ideapad slim 1-11ast-05 firmware, ideapad slim 1-14ast-05 firmware, thinkpad t550 firmware, thinkpad w550s firmware, thinkpad x1 carbon 3rd gen firmware, thinkpad x250 firmware, thinkpad yoga 15 firmware, v130-15igm firmware, v330-15ikb firmware, v330-15isk firmware, yoga s730-13iml firmware, yoga s940-14iil firmware, yoga s940-14iwl firmwareDiscoveredJul 16, 2021UpdatedNov 21, 2024

Some Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could allow an attacker with physical access the ability to write to the SPI flash storage.

View graph Watch Export
CVSS v3.1
6.8 MEDIUM
EPSS
0.24%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
CVSS v3.1 Detail
Attack VectorPHYSICAL
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityHIGH
IntegrityHIGH
AvailabilityHIGH
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Connections
22 relationships
Timeline
disclosure → media coverage
Jul 16, 2021
Disclosure — published as a CVE record. · last revised by NVD Nov 21, 2024