Vulnerability · Published Jul 16, 2021 · Assigned by lenovo
CVE-2021-3614
Medium 6.4
In plain English
A medium-severity security flaw in Notebook BIOS from Lenovo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Severity (CVSS 3.1)6.4Medium
Exploit odds (30 days)0.2%top 85.2% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A vulnerability was reported on some Lenovo Notebook systems that could allow an attacker with physical access to elevate privileges under certain conditions during a BIOS update performed by Lenovo Vantage.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Lenovo | Notebook BIOS | various |
Weakness: CWE-636 · Vector: CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
References
- https://support.lenovo.com/us/en/product_security/LEN-65529 x_refsource_MISC