CVE-2021-3843
A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow...
A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.
- Record
CVE-2021-3843- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2021-27086
A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.
- Record
EUVD-2021-27086- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jv7h-3pw9-7qjw No score
A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow...
A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.
- Record
GHSA-jv7h-3pw9-7qjw- Updated
- 2026-11-02
NVD
A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.
- Record
CVE-2021-3843- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
- lenovo thinkpad bios
- lenovo thinkpad 11e 3rd gen firmware
- lenovo thinkpad 11e 4th gen celeron firmware
- lenovo thinkpad 11e 4th gen i3 firmware
- lenovo thinkpad 11e 4th gen i5 firmware
- lenovo thinkpad 11e 4th gen i7 firmware
- lenovo thinkpad 11e 5th gen firmware
- lenovo thinkpad 11e yoga gen 6 firmware
- lenovo thinkpad 13 gen 2 firmware
- lenovo thinkpad l13 firmware
- lenovo thinkpad l13 gen 2 firmware
- lenovo thinkpad l13 yoga firmware
Show 18 moreShow less
- lenovo thinkpad l13 yoga gen 2 firmware
- lenovo thinkpad l14 firmware
- lenovo thinkpad l14 gen 1 firmware
- lenovo thinkpad l15 firmware
- lenovo thinkpad l15 gen 1 firmware
- lenovo thinkpad l380 firmware
- lenovo thinkpad l380 yoga firmware
- lenovo thinkpad l390 firmware
- lenovo thinkpad l390 yoga firmware
- lenovo thinkpad s2 gen 6 firmware
- lenovo thinkpad s2 yoga gen 6 firmware
- lenovo thinkpad s5 2nd gen firmware
- lenovo thinkpad t460 firmware
- lenovo thinkpad x12 detachable gen 1 firmware
- lenovo thinkpad x1 fold gen 1 firmware
- lenovo thinkpad x260 firmware
- lenovo thinkpad x380 yoga firmware
- lenovo thinkpad x390 yoga firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-3843 is a medium vulnerability (CVSS 6.7) in Lenovo Thinkpad Bios, published November 12, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. No source names a fixed version.