CVE-2021-3971: A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook devices that was mistakenly included in the…

PriorityP431medium6.7CVSS 3.1

AVLACLPRHUINSUCHIHAH

EPSS

1.29%

67.0th percentile

A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook devices that was mistakenly included in the BIOS image could allow an attacker with elevated privileges to modify firmware protection region by modifying an NVRAM variable.

Affected

74 ranges· showing 25

Vendor	Product	Version range	Fixed in
lenovo	ideapad_3-14ada05_firmware	< e8cn33ww	e8cn33ww
lenovo	ideapad_3-14ada6_firmware	< hbcn21ww	hbcn21ww
lenovo	ideapad_3-14alc6_firmware	< glcn43ww	glcn43ww
lenovo	ideapad_3-14are05_firmware	< dzcn42ww	dzcn42ww
lenovo	ideapad_3-14igl05_firmware	< emcn52ww	emcn52ww
lenovo	ideapad_3-14iil05_firmware	< dvcn23ww	dvcn23ww
lenovo	ideapad_3-15ada05_firmware	< e8cn33ww	e8cn33ww
lenovo	ideapad_3-15ada6_firmware	< hbcn21ww	hbcn21ww
lenovo	ideapad_3-15alc6_firmware	< glcn43ww	glcn43ww
lenovo	ideapad_3-15are05_firmware	< dzcn42ww	dzcn42ww
lenovo	ideapad_3-15igl05_firmware	< dvcn23ww	dvcn23ww
lenovo	ideapad_3-15iil05_firmware	< emcn52ww	emcn52ww
lenovo	ideapad_3-17ada05_firmware	< e8cn33ww	e8cn33ww
lenovo	ideapad_3-17ada6_firmware	< hbcn21ww	hbcn21ww
lenovo	ideapad_3-17alc6_firmware	< glcn43ww	glcn43ww
lenovo	ideapad_3-17are05_firmware	< dzcn42ww	dzcn42ww
lenovo	ideapad_3-17iil05_firmware	< emcn52ww	emcn52ww
lenovo	ideapad_5-15are05_firmware	< e7cn44ww	e7cn44ww
lenovo	ideapad_creator_5-15imh05_firmware	< egcn36ww	egcn36ww
lenovo	ideapad_gaming_3-15arh05_firmware	< fccn17ww	fccn17ww
lenovo	ideapad_gaming_3-15imh05_firmware	< egcn36ww	egcn36ww
lenovo	l3-15itl6_firmware	< gfcn23ww	gfcn23ww
lenovo	l340-15irh_firmware	< bgcn35ww	bgcn35ww
lenovo	l340-15iwl_firmware	< atcn46ww	atcn46ww
lenovo	l340-15iwl_touch_firmware	< atcn46ww	atcn46ww

CVSS provenance

nvdv3.16.7MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.