What is the CVSS score of CVE-2021-3614?

CVE-2021-3614 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Ideapad 1 11Ada05 Firmware CVE-2021-3614

MEDIUM

Not Failing Securely ('Failing Open') (CWE-636)

2021-07-16 psirt@lenovo.com

Lenovo Information Disclosure Ideapad 1 11Ada05 Firmware Ideapad 1 14Ada05 Firmware V130 15Ikb Firmware 100E 2Nd Gen Firmware 300E 2Nd Gen Firmware Ideapad 730 13Iml Firmware Ideapad Flex 5 14Alc05 Firmware Ideapad Flex 5 15Alc05 Firmware Ideapad 1 11Igl05 Firmware Ideapad 1 14Igl05 Firmware Ideapad S940 14Iil Firmware Ideapad S940 14Iwl Firmware Ideapad Slim 1 11Ast 05 Firmware Ideapad Slim 1 14Ast 05 Firmware V130 15Igm Firmware V330 15Ikb Firmware V330 15Isk Firmware Ideapad Yoga C940 15Irh Firmware Ideapad Yoga S730 13Iml Firmware Ideapad Yoga S940 14Iil Firmware Ideapad Yoga S940 14Iwl Firmware

6.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Physical

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Jul 16, 2021 - 21:15 nvd

MEDIUM 6.8

DescriptionNVD

AnalysisAI

A vulnerability was reported on some Lenovo Notebook systems that could allow an attacker with physical access to elevate privileges under certain conditions during a BIOS update performed by Lenovo. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-636. A vulnerability was reported on some Lenovo Notebook systems that could allow an attacker with physical access to elevate privileges under certain conditions during a BIOS update performed by Lenovo Vantage. Affected products include: Lenovo Ideapad 1-11Ada05 Firmware, Lenovo Ideapad 1-14Ada05 Firmware, Lenovo V130-15Ikb Firmware, Lenovo 100E 2Nd Gen Firmware, Lenovo 300E 2Nd Gen Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.