CVE-2021-3843 — Improper Input Validation in Lenovo Thinkpad L14 Firmware

CWE-20 — Improper Input Validation3 documents3 sources
Severity
6.7MEDIUMNVD
EPSS
0.0%
top 88.93%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
30
Lenovo Thinkpad L14 FirmwareLenovo Thinkpad L14 GEN 1 FirmwareLenovo Thinkpad L15 Firmware+27 more
Timeline
PublishedNov 12
Latest updateMay 24

Description

A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 0.8 | Impact: 5.9

Affected Packages30 packages

🔴Vulnerability Details

2
GHSA
GHSA-jv7h-3pw9-7qjw: A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privileges↗2022-05-24
▶
CVEList
CVE-2021-3843: A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privileges↗2021-11-12
▶
CVE-2021-3843 — Improper Input Validation in Lenovo | cvebase