What is the CVSS score of CVE-2021-3843?

CVE-2021-3843 has a CVSS 3.1 base score of 6.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Thinkpad 11E 3Rd Gen Firmware CVE-2021-3843

MEDIUM

Improper Input Validation (CWE-20)

2021-11-12 psirt@lenovo.com

RCE Thinkpad 11E 3Rd Gen Firmware Thinkpad 11E 4Th Gen I3 Firmware Thinkpad 11E 4Th Gen I7 Firmware Thinkpad 11E 4Th Gen I5 Firmware Thinkpad 11E 4Th Gen Celeron Firmware Thinkpad 11E Yoga Gen 6 Firmware Thinkpad 13 Gen 2 Firmware Thinkpad L13 Firmware Thinkpad L13 Gen 2 Firmware Thinkpad L13 Yoga Firmware Thinkpad L13 Yoga Gen 2 Firmware Thinkpad L14 Gen 1 Firmware Thinkpad L14 Firmware Thinkpad L15 Gen 1 Firmware Thinkpad L15 Firmware Thinkpad L380 Firmware Thinkpad L380 Yoga Firmware Thinkpad L390 Yoga Firmware Thinkpad L390 Firmware Thinkpad S5 2Nd Gen Firmware Thinkpad T460 Firmware Thinkpad S2 Gen 6 Firmware Thinkpad S2 Yoga Gen 6 Firmware Thinkpad X12 Detachable Gen 1 Firmware Thinkpad X260 Firmware Thinkpad X380 Yoga Firmware Thinkpad X390 Yoga Firmware Thinkpad 11E 5Th Gen Firmware Thinkpad X1 Fold Gen 1 Firmware

6.7

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.7 MEDIUM

AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Nov 12, 2021 - 22:15 nvd

MEDIUM 6.7

DescriptionNVD

A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.

AnalysisAI

A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-20. A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code. Affected products include: Lenovo Thinkpad 11E 3Rd Gen Firmware, Lenovo Thinkpad 11E 4Th Gen I3 Firmware, Lenovo Thinkpad 11E 4Th Gen I7 Firmware, Lenovo Thinkpad 11E 4Th Gen I5 Firmware, Lenovo Thinkpad 11E 4Th Gen Celeron Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.