CVE-2021-3453

published 2021-07-16

CVE-2021-3453: Some Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could allow an attacker with physical access…

Priority P4 17 medium 4.6 CVSS 3.1

AV P AC L PR N UI N S U C N I H A N

Some Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could allow an attacker with physical access the ability to write to the SPI flash storage.

Affected

9 ranges

Vendor	Product	Version range	Fixed in
lenovo	bios	—	—
lenovo	ideacentre_aio_5-24imb05_firmware	< 2021-09-30	2021-09-30
lenovo	ideacentre_aio_5-74imb05_firmware	< 2021-09-30	2021-09-30
lenovo	thinkpad_helix_firmware	—	—
lenovo	thinkpad_t550_firmware	—	—
lenovo	thinkpad_w550s_firmware	—	—
lenovo	thinkpad_x1_carbon_3rd_gen_firmware	—	—
lenovo	thinkpad_x250_firmware	—	—
lenovo	thinkpad_yoga_15_firmware	—	—

CVSS provenance

nvd v3.1 4.6 MEDIUM CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

nvd v2.0 2.1 LOW AV:L/AC:L/Au:N/C:N/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-693