VULNERABILITY INTELLIGENCE

CVE-2021-3972

CVSS score6.7 MEDIUM
EPSS probability2.86%
CISA KEVNot currently listed
Published2022-04-22
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

A potential vulnerability by a driver used during manufacturing process on some consumer Lenovo Notebook devices' BIOS that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.

Weakness classification

  • psirt@lenovo.com: CWE-489
  • nvd@nist.gov: NVD-CWE-Other

Primary references