CVE-2021-4210
A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo...
A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code.
- Record
CVE-2021-4210- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2021-34068
A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code.
- Record
EUVD-2021-34068- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-2gc6-xpq3-f7gm
A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo...
A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code.
- Record
GHSA-2gc6-xpq3-f7gm- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-269
- Updated
- 2026-11-02
NVD
A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code.
- Record
CVE-2021-4210- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-20
- Updated
- 2026-11-02
Affected products
- lenovo a540-24icb firmware
- lenovo a540-27icb firmware
- lenovo bios
- lenovo ideacentre 5-14imb05 firmware
- lenovo ideacentre aio 3-22ada6 firmware
- lenovo ideacentre aio 3-22iil5 firmware
- lenovo ideacentre aio 3-22itl6 firmware
- lenovo ideacentre aio 3-24ada6 firmware
- lenovo ideacentre aio 3-24iil5 firmware
- lenovo ideacentre aio 3-24itl6 firmware
- lenovo ideacentre aio 3-27itl6 firmware
- lenovo ideacentre c5-14imb05 firmware
Show 21 moreShow less
- lenovo ideacentre g5-14imb05 firmware
- lenovo stadia ggp-120 firmware
- lenovo thinkcentre m700 firmware
- lenovo thinkcentre m700 tiny firmware
- lenovo thinkcentre m70a firmware
- lenovo thinkcentre m75n firmware
- lenovo thinkcentre m800 firmware
- lenovo thinkcentre m810z firmware
- lenovo thinkcentre m820z firmware
- lenovo thinkcentre m900 firmware
- lenovo thinkcentre m900x firmware
- lenovo thinkcentre m90a gen2 firmware
- lenovo thinkcentre m910z firmware
- lenovo thinkcentre x1 firmware
- lenovo thinkedge se30 firmware
- lenovo thinkstation p310 firmware
- lenovo thinkstation p520 firmware
- lenovo thinkstation p520c firmware
- lenovo v410z firmware
- lenovo v50t-13imb firmware
- lenovo v540-24iwl firmware
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-4210 is a medium vulnerability (CVSS 6.7) in Lenovo A540-24icb Firmware, published April 22, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.26%, the 17th percentile. No source names a fixed version.