What is the CVSS score of CVE-2021-3453?

CVE-2021-3453 has a CVSS 3.1 base score of 4.6 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Thinkpad Helix Firmware CVE-2021-3453

MEDIUM

Protection Mechanism Failure (CWE-693)

2021-07-16 psirt@lenovo.com

Intel Lenovo Information Disclosure Thinkpad Helix Firmware Thinkpad T550 Firmware Thinkpad W550S Firmware Thinkpad X1 Carbon 3Rd Gen Firmware Thinkpad X250 Firmware Thinkpad Yoga 15 Firmware 730S 13Iml Firmware Ideapad 1 11Igl05 Firmware Ideapad 1 14Igl05 Firmware Ideapad S940 14Iil Firmware Ideapad S940 14Iwl Firmware Ideapad Slim 1 11Ast 05 Firmware Ideapad Slim 1 14Ast 05 Firmware V130 15Igm Firmware V330 15Ikb Firmware V330 15Isk Firmware Yoga S730 13Iml Firmware Yoga S940 14Iil Firmware Yoga S940 14Iwl Firmware Ideacentre Aio 5 24Imb05 Firmware Ideacentre Aio 5 74Imb05 Firmware

4.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.6 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

CVE Published

Jul 16, 2021 - 21:15 nvd

MEDIUM 4.6

DescriptionNVD

AnalysisAI

Some Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could allow an attacker with physical access the ability to write to the SPI flash. Rated medium severity (CVSS 4.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-693. Some Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could allow an attacker with physical access the ability to write to the SPI flash storage. Affected products include: Lenovo Thinkpad Helix Firmware, Lenovo Thinkpad T550 Firmware, Lenovo Thinkpad W550S Firmware, Lenovo Thinkpad X1 Carbon 3Rd Gen Firmware, Lenovo Thinkpad X250 Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.