7.2

CVE-2021-3843

A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Lenovo ≫ Thinkpad 11e 3rd Gen Firmware SwEdition braswell Version <= 1.22
   Lenovo ≫ Thinkpad 11e 3rd Gen Version -
Lenovo ≫ Thinkpad 11e 3rd Gen Firmware SwEdition skylate Version <= 1.29
   Lenovo ≫ Thinkpad 11e 3rd Gen Version -
Lenovo ≫ Thinkpad 13 Gen 2 Firmware Version <= 1.29
   Lenovo ≫ Thinkpad 13 Gen 2 Version -
Lenovo ≫ Thinkpad L13 Firmware Version <= 1.31
   Lenovo ≫ Thinkpad L13 Version -
Lenovo ≫ Thinkpad L13 Gen 2 Firmware SwEdition non-vpro Version <= 1.11
   Lenovo ≫ Thinkpad L13 Gen 2 Version -
Lenovo ≫ Thinkpad L13 Gen 2 Firmware SwEdition vpro Version <= 1.08
   Lenovo ≫ Thinkpad L13 Gen 2 Version -
Lenovo ≫ Thinkpad L13 Yoga Firmware Version <= 1.31
   Lenovo ≫ Thinkpad L13 Yoga Version -
Lenovo ≫ Thinkpad L13 Yoga Gen 2 Firmware SwEdition non-vpro Version <= 1.11
   Lenovo ≫ Thinkpad L13 Yoga Gen 2 Version -
Lenovo ≫ Thinkpad L13 Yoga Gen 2 Firmware SwEdition vpro Version <= 1.08
   Lenovo ≫ Thinkpad L13 Yoga Gen 2 Version -
Lenovo ≫ Thinkpad L14 Gen 1 Firmware Version < 1.15
   Lenovo ≫ Thinkpad L14 Gen 1 Version -
Lenovo ≫ Thinkpad L14 Firmware Version < 1.20.1.17
   Lenovo ≫ Thinkpad L14 Version -
Lenovo ≫ Thinkpad L15 Gen 1 Firmware Version < 1.15
   Lenovo ≫ Thinkpad L15 Gen 1 Version -
Lenovo ≫ Thinkpad L15 Firmware Version < 1.20.1.17
   Lenovo ≫ Thinkpad L15 Version -
Lenovo ≫ Thinkpad L380 Firmware Version <= 1.26
   Lenovo ≫ Thinkpad L380 Version -
Lenovo ≫ Thinkpad L380 Yoga Firmware Version <= 1.26
   Lenovo ≫ Thinkpad L380 Yoga Version -
Lenovo ≫ Thinkpad L390 Yoga Firmware Version <= 1.35
   Lenovo ≫ Thinkpad L390 Yoga Version -
Lenovo ≫ Thinkpad L390 Firmware Version <= 1.35
   Lenovo ≫ Thinkpad L390 Version -
Lenovo ≫ Thinkpad S5 2nd Gen Firmware Version <= 1.28
   Lenovo ≫ Thinkpad S5 2nd Gen Version -
Lenovo ≫ Thinkpad T460 Firmware Version <= 1.43.1.11
   Lenovo ≫ Thinkpad T460 Version -
Lenovo ≫ Thinkpad S2 Gen 6 Firmware Version <= 2021-09-30
   Lenovo ≫ Thinkpad S2 Gen 6 Version -
Lenovo ≫ Thinkpad S2 Yoga Gen 6 Firmware Version <= 2021-09-30
   Lenovo ≫ Thinkpad S2 Yoga Gen 6 Version -
Lenovo ≫ Thinkpad X260 Firmware Version <= 1.47\/1.15
   Lenovo ≫ Thinkpad X260 Version -
Lenovo ≫ Thinkpad X380 Yoga Firmware Version <= 1.34
   Lenovo ≫ Thinkpad X380 Yoga Version -
Lenovo ≫ Thinkpad X390 Yoga Firmware Version < n2let87w
   Lenovo ≫ Thinkpad X390 Yoga Version -
Lenovo ≫ Thinkpad 11e 5th Gen Firmware Version <= 1.13
   Lenovo ≫ Thinkpad 11e 5th Gen Version -
Lenovo ≫ Thinkpad 11e 5th Gen Firmware Version <= 1.13
   Lenovo ≫ Thinkpad Yoga 370 Version -
Lenovo ≫ Thinkpad X1 Fold Gen 1 Firmware Version < n2pet50w
   Lenovo ≫ Thinkpad X1 Fold Gen 1 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.27% 0.183
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NIST 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
Lenovo 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

https://support.lenovo.com/us/en/product_security/LEN-72619
Vendor Advisory