cbcvebase.
CVE-2021-3970
published 2022-04-22

CVE-2021-3970: A potential vulnerability in LenovoVariable SMI Handler due to insufficient validation in some Lenovo Notebook models BIOS may allow an attacker with local…

PriorityP432medium6.7CVSS 3.1
AVLACLPRHUINSUCHIHAH
EPSS
1.31%
67.5th percentile
A potential vulnerability in LenovoVariable SMI Handler due to insufficient validation in some Lenovo Notebook models BIOS may allow an attacker with local access and elevated privileges to execute arbitrary code.

Affected

98 ranges· showing 25
VendorProductVersion rangeFixed in
lenovoideapad_3-14ada05_firmware< e8cn33wwe8cn33ww
lenovoideapad_3-14ada6_firmware< hbcn21wwhbcn21ww
lenovoideapad_3-14alc6_firmware< glcn43wwglcn43ww
lenovoideapad_3-14are05_firmware< dzcn42wwdzcn42ww
lenovoideapad_3-14igl05_firmware< emcn52wwemcn52ww
lenovoideapad_3-14iil05_firmware< dvcn23wwdvcn23ww
lenovoideapad_3-14iml05_firmware< dxcn41wwdxcn41ww
lenovoideapad_3-14itl05_firmware< gccn26wwgccn26ww
lenovoideapad_3-14itl6_firmware< ggcn33wwggcn33ww
lenovoideapad_3-15ada05_firmware< e8cn33wwe8cn33ww
lenovoideapad_3-15ada6_firmware< hbcn21wwhbcn21ww
lenovoideapad_3-15alc6_firmware< glcn43wwglcn43ww
lenovoideapad_3-15are05_firmware< dzcn42wwdzcn42ww
lenovoideapad_3-15igl05_firmware< dvcn23wwdvcn23ww
lenovoideapad_3-15iil05_firmware< emcn52wwemcn52ww
lenovoideapad_3-15iml05_firmware< dxcn41wwdxcn41ww
lenovoideapad_3-15itl05_firmware< gccn26wwgccn26ww
lenovoideapad_3-15itl6_firmware< ggcn33wwggcn33ww
lenovoideapad_3-17ada05_firmware< e8cn33wwe8cn33ww
lenovoideapad_3-17ada6_firmware< hbcn21wwhbcn21ww
lenovoideapad_3-17alc6_firmware< glcn43wwglcn43ww
lenovoideapad_3-17are05_firmware< dzcn42wwdzcn42ww
lenovoideapad_3-17iil05_firmware< emcn52wwemcn52ww
lenovoideapad_3-17iml05_firmware< dxcn41wwdxcn41ww
lenovoideapad_3-17itl6_firmware< ggcn33wwggcn33ww

CVSS provenance

nvdv3.16.7MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.