CVE-2021-3614 | ByteOS Network

Vulnerability Details :

CVE-2021-3614

Assigner-lenovo

Assigner Org ID-da227ddf-6e25-4b41-b023-0f976dcaca4b

Published At-16 Jul, 2021 | 20:30

Updated At-03 Aug, 2024 | 17:01

A vulnerability was reported on some Lenovo Notebook systems that could allow an attacker with physical access to elevate privileges under certain conditions during a BIOS update performed by Lenovo Vantage.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:lenovo

Assigner Org ID:da227ddf-6e25-4b41-b023-0f976dcaca4b

Published At:16 Jul, 2021 | 20:30

Updated At:03 Aug, 2024 | 17:01

▼CVE Numbering Authority (CNA)

A vulnerability was reported on some Lenovo Notebook systems that could allow an attacker with physical access to elevate privileges under certain conditions during a BIOS update performed by Lenovo Vantage.

Affected Products

Vendor

Lenovo Group Limited

Product

Versions

Affected

various

Problem Types

Type	CWE ID	Description
CWE	CWE-636	CWE-636 Not Failing Securely ('Failing Open')

Type: CWE

CWE ID: CWE-636

Description: CWE-636 Not Failing Securely ('Failing Open')

Metrics

Version	Base score	Base severity	Vector
3.1	6.4	MEDIUM	CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Version: 3.1

Base score: 6.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Solutions

Update system firmware to the version (or newer) indicated for your model in the Product Impact section of LEN-65529.

Credits

Lenovo thanks Tim Boyd, NCC Group for reporting this issue.

References

Hyperlink	Resource
https://support.lenovo.com/us/en/product_security/LEN-65529	x_refsource_MISC

Hyperlink: https://support.lenovo.com/us/en/product_security/LEN-65529

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://support.lenovo.com/us/en/product_security/LEN-65529	x_refsource_MISC x_transferred

Hyperlink: https://support.lenovo.com/us/en/product_security/LEN-65529

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

Source:psirt@lenovo.com

Published At:16 Jul, 2021 | 21:15

Updated At:30 Jul, 2021 | 12:56

A vulnerability was reported on some Lenovo Notebook systems that could allow an attacker with physical access to elevate privileges under certain conditions during a BIOS update performed by Lenovo Vantage.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	6.8	MEDIUM	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Secondary	3.1	6.4	MEDIUM	CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Primary	2.0	4.4	MEDIUM	AV:L/AC:M/Au:N/C:P/I:P/A:P

Type: Primary

Version: 3.1

Base score: 6.8

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Secondary

Version: 3.1

Base score: 6.4

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:P/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 4.4

Base severity: MEDIUM

Vector:

AV:L/AC:M/Au:N/C:P/I:P/A:P

CPE Matches

Lenovo Group Limited

>>ideapad_1-11ada05_firmware>>fqcn19ww

cpe:2.3:o:lenovo:ideapad_1-11ada05_firmware:fqcn19ww:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_1-11ada05>>-

cpe:2.3:h:lenovo:ideapad_1-11ada05:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_1-14ada05_firmware>>fqcn19ww

cpe:2.3:o:lenovo:ideapad_1-14ada05_firmware:fqcn19ww:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_1-14ada05>>-

cpe:2.3:h:lenovo:ideapad_1-14ada05:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>v130-15ikb_firmware>>-

cpe:2.3:o:lenovo:v130-15ikb_firmware:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>v130-15ikb>>-

cpe:2.3:h:lenovo:v130-15ikb:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>100e_2nd_gen_firmware>>-

cpe:2.3:o:lenovo:100e_2nd_gen_firmware:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>100e_2nd_gen>>-

cpe:2.3:h:lenovo:100e_2nd_gen:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>300e_2nd_gen_firmware>>-

cpe:2.3:o:lenovo:300e_2nd_gen_firmware:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>300e_2nd_gen>>-

cpe:2.3:h:lenovo:300e_2nd_gen:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_730-13iml_firmware>>-

cpe:2.3:o:lenovo:ideapad_730-13iml_firmware:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_730-13iml>>-

cpe:2.3:h:lenovo:ideapad_730-13iml:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_flex_5-14alc05_firmware>>-

cpe:2.3:o:lenovo:ideapad_flex_5-14alc05_firmware:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_flex_5-14alc05>>-

cpe:2.3:h:lenovo:ideapad_flex_5-14alc05:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_flex_5-15alc05_firmware>>-

cpe:2.3:o:lenovo:ideapad_flex_5-15alc05_firmware:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_flex_5-15alc05>>-

cpe:2.3:h:lenovo:ideapad_flex_5-15alc05:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_1-11igl05_firmware>>-

cpe:2.3:o:lenovo:ideapad_1-11igl05_firmware:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_1-11igl05>>-

cpe:2.3:h:lenovo:ideapad_1-11igl05:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_1-14igl05_firmware>>-

cpe:2.3:o:lenovo:ideapad_1-14igl05_firmware:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_1-14igl05>>-

cpe:2.3:h:lenovo:ideapad_1-14igl05:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_s940-14iil_firmware>>-

cpe:2.3:o:lenovo:ideapad_s940-14iil_firmware:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_s940-14iil>>-

cpe:2.3:h:lenovo:ideapad_s940-14iil:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_s940-14iwl_firmware>>-

cpe:2.3:o:lenovo:ideapad_s940-14iwl_firmware:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_s940-14iwl>>-

cpe:2.3:h:lenovo:ideapad_s940-14iwl:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_slim_1-11ast-05_firmware>>-

cpe:2.3:o:lenovo:ideapad_slim_1-11ast-05_firmware:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_slim_1-11ast-05>>-

cpe:2.3:h:lenovo:ideapad_slim_1-11ast-05:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_slim_1-14ast-05_firmware>>-

cpe:2.3:o:lenovo:ideapad_slim_1-14ast-05_firmware:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_slim_1-14ast-05>>-

cpe:2.3:h:lenovo:ideapad_slim_1-14ast-05:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>v130-15igm_firmware>>-

cpe:2.3:o:lenovo:v130-15igm_firmware:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>v130-15igm>>-

cpe:2.3:h:lenovo:v130-15igm:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>v130-15ikb_firmware>>-

cpe:2.3:o:lenovo:v130-15ikb_firmware:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>v130-15ikb>>-

cpe:2.3:h:lenovo:v130-15ikb:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>v330-15ikb_firmware>>-

cpe:2.3:o:lenovo:v330-15ikb_firmware:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>v330-15ikb>>-

cpe:2.3:h:lenovo:v330-15ikb:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>v330-15isk_firmware>>-

cpe:2.3:o:lenovo:v330-15isk_firmware:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>v330-15isk>>-

cpe:2.3:h:lenovo:v330-15isk:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_yoga_c940-15irh_firmware>>-

cpe:2.3:o:lenovo:ideapad_yoga_c940-15irh_firmware:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_yoga_c940-15irh>>-

cpe:2.3:h:lenovo:ideapad_yoga_c940-15irh:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_yoga_s730-13iml_firmware>>-

cpe:2.3:o:lenovo:ideapad_yoga_s730-13iml_firmware:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_yoga_s730-13iml>>-

cpe:2.3:h:lenovo:ideapad_yoga_s730-13iml:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_yoga_s940-14iil_firmware>>-

cpe:2.3:o:lenovo:ideapad_yoga_s940-14iil_firmware:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_yoga_s940-14iil>>-

cpe:2.3:h:lenovo:ideapad_yoga_s940-14iil:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_yoga_s940-14iwl_firmware>>-

cpe:2.3:o:lenovo:ideapad_yoga_s940-14iwl_firmware:-:*:*:*:*:*:*:*

Lenovo Group Limited

>>ideapad_yoga_s940-14iwl>>-

cpe:2.3:h:lenovo:ideapad_yoga_s940-14iwl:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
NVD-CWE-noinfo	Primary	nvd@nist.gov
CWE-636	Secondary	psirt@lenovo.com

CWE ID: NVD-CWE-noinfo

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-636

Type: Secondary

Source: psirt@lenovo.com

References

Hyperlink	Source	Resource
https://support.lenovo.com/us/en/product_security/LEN-65529	psirt@lenovo.com	Vendor Advisory

Hyperlink: https://support.lenovo.com/us/en/product_security/LEN-65529

Source: psirt@lenovo.com

Resource:

Vendor Advisory