CVE-2021-3972

A potential vulnerability by a driver used during manufacturing process on some consumer Lenovo Notebook devices' BIOS that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.

Affected

Lenovo · Notebook BIOS

CVSS v3.1 NVD

6.7 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

4.6 MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P

EPSS

2.83% chance of exploitation in the next 30 days, 86th percentile

Published

2022-04-22

Updated

2024-08-03

Proof-of-concept exploits (1)

• killvxk/CVE-2021-39724★ · 2022-04-21

Security advisories

• https://support.lenovo.com/us/en/product_security/LEN-73440

References

• CVE Record
• NVD entry

Related

• CVE-2018-14772
• CVE-2019-19383
• CVE-2022-1040
• CVE-2022-26809
• CVE-2023-22515
• CVE-2024-38193