CVE-2021-3972 MEDIUM

CVE-2021-3972

Vendor Lenovo
Product Notebook BIOS
Weakness CWE-489
Published April 22, 2022
Last update August 3, 2024

CVSS base score

6.7/10
Attack vector Local
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

A potential vulnerability by a driver used during manufacturing process on some consumer Lenovo Notebook devices' BIOS that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.

Key dates

02Disclosure timeline

April 22, 2022 CVE published
August 3, 2024 Record updated