7.2

CVE-2021-3719

A potential vulnerability in the SMI callback function that saves and restore boot script tables used for resuming from sleep state in some ThinkCentre and ThinkStation models may allow an attacker with local access and elevated privileges to execute arbitrary code.

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Lenovo ≫ Thinkcentre E93 Firmware Version < fbktdfa
   Lenovo ≫ Thinkcentre E93 Version-
Lenovo ≫ Thinkcentre M600 Firmware Version < m00kt65a
   Lenovo ≫ Thinkcentre M600 Version-
Lenovo ≫ Thinkcentre M700 Tiny Firmware Version < fwktb9a
   Lenovo ≫ Thinkcentre M700 Tiny Version-
Lenovo ≫ Thinkcentre M73 Firmware Version < fhkt86a
   Lenovo ≫ Thinkcentre M73 Version-
Lenovo ≫ Thinkcentre M73p Firmware Version < fbktdfa
   Lenovo ≫ Thinkcentre M73p Version-
Lenovo ≫ Thinkcentre M800 Firmware Version < fwktb9a
   Lenovo ≫ Thinkcentre M800 Version-
Lenovo ≫ Thinkcentre M818z Firmware Version < m1ekt23a
   Lenovo ≫ Thinkcentre M818z Version-
Lenovo ≫ Thinkcentre M83 Firmware Version < fbktdfa
   Lenovo ≫ Thinkcentre M83 Version-
Lenovo ≫ Thinkcentre M900 Firmware Version < fwktb9a
   Lenovo ≫ Thinkcentre M900 Version-
Lenovo ≫ Thinkcentre M900x Firmware Version < fwktb9a
   Lenovo ≫ Thinkcentre M900x Version-
Lenovo ≫ Thinkcentre M93 Firmware Version < fbktdfa
   Lenovo ≫ Thinkcentre M93 Version-
Lenovo ≫ Thinkcentre M93p Firmware Version < fbktdfa
   Lenovo ≫ Thinkcentre M93p Version-
Lenovo ≫ Thinkcentre M4500q Firmware Version < fhkt86a
   Lenovo ≫ Thinkcentre M4500q Version-
Lenovo ≫ Thinkcentre M6500t/s Firmware Version < fbktdfa
   Lenovo ≫ Thinkcentre M6500t/s Version-
Lenovo ≫ Thinkcentre M8500t/s Firmware Version < fbktdfa
   Lenovo ≫ Thinkcentre M8500t/s Version-
Lenovo ≫ Thinkcentre X1 Firmware Version < m0hkt50a
   Lenovo ≫ Thinkcentre X1 Version-
Lenovo ≫ Thinkstation P300 Firmware Version < fbktdfa
   Lenovo ≫ Thinkstation P300 Version-
Lenovo ≫ Thinkstation P500 Firmware Version < a4ktaba
   Lenovo ≫ Thinkstation P500 Version-
Lenovo ≫ Thinkstation P700 Firmware Version < a5ktaba
   Lenovo ≫ Thinkstation P700 Version-
Lenovo ≫ Thinkstation P900 Firmware Version < a6ktaba
   Lenovo ≫ Thinkstation P900 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.04% 0.078
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
psirt@lenovo.com 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.