7.2

CVE-2021-4210

A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code.

Data is provided by the National Vulnerability Database (NVD)
Lenovo ≫ Stadia Ggp-120 Firmware Version-
   Lenovo ≫ Stadia Ggp-120 Version-
Lenovo ≫ Thinkedge Se30 Firmware Version-
   Lenovo ≫ Thinkedge Se30 Version-
Lenovo ≫ V540-24iwl Firmware Version-
   Lenovo ≫ V540-24iwl Version-
Lenovo ≫ Thinkstation P520 Firmware Version-
   Lenovo ≫ Thinkstation P520 Version-
Lenovo ≫ Thinkstation P310 Firmware Version-
   Lenovo ≫ Thinkstation P310 Version-
Lenovo ≫ V50t-13imb Firmware Version-
   Lenovo ≫ V50t-13imb Version-
Lenovo ≫ A540-27icb Firmware Version-
   Lenovo ≫ A540-27icb Version-
Lenovo ≫ A540-24icb Firmware Version-
   Lenovo ≫ A540-24icb Version-
Lenovo ≫ V410z Firmware Version-
   Lenovo ≫ V410z Version-
Lenovo ≫ Thinkcentre M910z Firmware Version-
   Lenovo ≫ Thinkcentre M910z Version-
Lenovo ≫ Thinkcentre M70a Firmware Version-
   Lenovo ≫ Thinkcentre M70a Version-
Lenovo ≫ Thinkcentre M75n Firmware Version-
   Lenovo ≫ Thinkcentre M75n Version-
Lenovo ≫ Thinkcentre X1 Firmware Version-
   Lenovo ≫ Thinkcentre X1 Version-
Lenovo ≫ Thinkcentre M900 Firmware Version-
   Lenovo ≫ Thinkcentre M900 Version-
Lenovo ≫ Thinkcentre M810z Firmware Version-
   Lenovo ≫ Thinkcentre M810z Version-
Lenovo ≫ Thinkcentre M820z Firmware Version-
   Lenovo ≫ Thinkcentre M820z Version-
Lenovo ≫ Thinkcentre M900x Firmware Version-
   Lenovo ≫ Thinkcentre M900x Version-
Lenovo ≫ Thinkcentre M800 Firmware Version-
   Lenovo ≫ Thinkcentre M800 Version-
Lenovo ≫ Thinkcentre M700 Firmware Version-
   Lenovo ≫ Thinkcentre M700 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.11% 0.3
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
psirt@lenovo.com 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.