Vulnerability · Published Jul 16, 2021 · Assigned by lenovo

CVE-2021-3453

Medium 6.8

In plain English

A medium-severity security flaw in BIOS from Lenovo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.2%top 85.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Some Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could allow an attacker with physical access the ability to write to the SPI flash storage.

Affected products (as reported)

Vendor	Product	Versions
Lenovo	BIOS	various

Weakness: CWE-693 · Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://support.lenovo.com/us/en/product_security/LEN-65529 x_refsource_MISC