CVE-2021-3519

published 2021-11-12

CVE-2021-3519: A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At Boot Device List"…

Priority P4 26 medium 6.8 CVSS 3.1

AV P AC L PR N UI N S U C H I H A H

A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At Boot Device List" BIOS setting is Yes.

Affected

63 ranges · showing 25

Vendor	Product	Version range	Fixed in
lenovo	desktop_bios	—	—
lenovo	ideacentre_3-07imb05_firmware	< m2vkt18a	m2vkt18a
lenovo	ideacentre_310s-08igm_firmware	<= m1tkt31a	—
lenovo	ideacentre_5-14imb05_firmware	< o4hkt33a	o4hkt33a
lenovo	ideacentre_5-14iob6_firmware	< m3gkt29a	m3gkt29a
lenovo	ideacentre_510a-15arr_firmware	<= o4dkt41a	—
lenovo	ideacentre_510s-07icb_firmware	< m22kt46a	m22kt46a
lenovo	ideacentre_510s-07ick_firmware	< m30kt24a	m30kt24a
lenovo	ideacentre_510s-07ick_firmware	< m30kt23a	m30kt23a
lenovo	ideacentre_c5-14mb05_firmware	< o4hkt33a	o4hkt33a
lenovo	ideacentre_creator_5-14iob6_firmware	< m3gkt29a	m3gkt29a
lenovo	ideacentre_g5-14imb05_firmware	< o4hkt33a	o4hkt33a
lenovo	ideacentre_gaming_5-14iob6_firmware	< m3gkt29a	m3gkt29a
lenovo	thinkcentre_e75_t_s_firmware	< m16kt67a	m16kt67a
lenovo	thinkcentre_m60e_tiny_firmware	< m3skt1ea	m3skt1ea
lenovo	thinkcentre_m630e_firmware	< m28kt36a	m28kt36a
lenovo	thinkcentre_m70a_firmware	<= m2skt21a	—
lenovo	thinkcentre_m70a_gen_2_firmware	< m3nkt17a	m3nkt17a
lenovo	thinkcentre_m70c_firmware	< m2vkt18a	m2vkt18a
lenovo	thinkcentre_m70q_firmware	< m2wkt49a	m2wkt49a
lenovo	thinkcentre_m70s_firmware	< m2tkt3ca	m2tkt3ca
lenovo	thinkcentre_m70t_firmware	< m2tkt3ca	m2tkt3ca
lenovo	thinkcentre_m710e_firmware	< m1zkt37a	m1zkt37a
lenovo	thinkcentre_m710s_firmware	< m16kt67a	m16kt67a
lenovo	thinkcentre_m710t_firmware	< m16kt67a	m16kt67a

CVSS provenance

nvd v3.1 6.8 MEDIUM CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 6.9 MEDIUM AV:L/AC:M/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-287