A vulnerability was reported on some Lenovo Notebook systems that could allow an attacker…
Priority LOW 30CWE-636Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A vulnerability was reported on some Lenovo Notebook systems that could allow an attacker with physical access to elevate privileges under certain conditions during a BIOS update performed by Lenovo Vantage.
Why it matters now
EPSS 0.00237 14th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Lenovo | Notebook BIOS | various | — | No fix listed | CNA |
- Notebook BIOS VendorLenovo Affected various Fixed in — No fix listed CNA
CPE configurations NVD · 42
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:lenovo:ideapad_1-11ada05_firmware:fqcn19ww:*:*:*:*:*:*:* | fqcn19ww | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:ideapad_1-11ada05:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:ideapad_1-14ada05_firmware:fqcn19ww:*:*:*:*:*:*:* | fqcn19ww | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:ideapad_1-14ada05:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:v130-15ikb_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:v130-15ikb:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:100e_2nd_gen_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:100e_2nd_gen:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:300e_2nd_gen_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:300e_2nd_gen:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
- cpe:2.3:o:lenovo:ideapad_1-11ada05_firmware:fqcn19ww:*:*:*:*:*:*:* Versions fqcn19ww Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:ideapad_1-11ada05:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:ideapad_1-14ada05_firmware:fqcn19ww:*:*:*:*:*:*:* Versions fqcn19ww Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:ideapad_1-14ada05:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:v130-15ikb_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:v130-15ikb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:100e_2nd_gen_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:100e_2nd_gen:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:300e_2nd_gen_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:300e_2nd_gen:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Show 32 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:lenovo:ideapad_730-13iml_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:ideapad_730-13iml:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:ideapad_flex_5-14alc05_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:ideapad_flex_5-14alc05:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:ideapad_flex_5-15alc05_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:ideapad_flex_5-15alc05:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:ideapad_1-11igl05_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:ideapad_1-11igl05:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:ideapad_1-14igl05_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:ideapad_1-14igl05:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:ideapad_s940-14iil_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:ideapad_s940-14iil:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:ideapad_s940-14iwl_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:ideapad_s940-14iwl:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:ideapad_slim_1-11ast-05_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:ideapad_slim_1-11ast-05:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:ideapad_slim_1-14ast-05_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:ideapad_slim_1-14ast-05:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:v130-15igm_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:v130-15igm:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:v330-15ikb_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:v330-15ikb:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:v330-15isk_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:v330-15isk:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:ideapad_yoga_c940-15irh_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:ideapad_yoga_c940-15irh:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:ideapad_yoga_s730-13iml_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:ideapad_yoga_s730-13iml:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:ideapad_yoga_s940-14iil_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:ideapad_yoga_s940-14iil:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:ideapad_yoga_s940-14iwl_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:ideapad_yoga_s940-14iwl:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
- cpe:2.3:o:lenovo:ideapad_730-13iml_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:ideapad_730-13iml:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:ideapad_flex_5-14alc05_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:ideapad_flex_5-14alc05:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:ideapad_flex_5-15alc05_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:ideapad_flex_5-15alc05:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:ideapad_1-11igl05_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:ideapad_1-11igl05:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:ideapad_1-14igl05_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:ideapad_1-14igl05:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:ideapad_s940-14iil_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:ideapad_s940-14iil:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:ideapad_s940-14iwl_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:ideapad_s940-14iwl:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:ideapad_slim_1-11ast-05_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:ideapad_slim_1-11ast-05:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:ideapad_slim_1-14ast-05_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:ideapad_slim_1-14ast-05:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:v130-15igm_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:v130-15igm:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:v330-15ikb_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:v330-15ikb:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:v330-15isk_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:v330-15isk:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:ideapad_yoga_c940-15irh_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:ideapad_yoga_c940-15irh:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:ideapad_yoga_s730-13iml_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:ideapad_yoga_s730-13iml:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:ideapad_yoga_s940-14iil_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:ideapad_yoga_s940-14iil:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:ideapad_yoga_s940-14iwl_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:ideapad_yoga_s940-14iwl:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-3614
- 2026-10-03 Alias added: GHSA-g8m2-gv7w-7c9h
References
More Lenovo 100e 2nd Gen Firmware vulnerabilities
- TI-2022-01752 Heap-based buffer overflow in Lenovo BIOS CVSS 3.1HIGH 7.8
- TI-2019-08001 There is a vulnerability with the Dolby DAX2 API system services in which a… CVSS 3.0MEDIUM 6.5
Sources
- CVE-2021-3614 · CVE Program
- CVE-2021-3614 · NVD
- FIRST EPSS
- GHSA-g8m2-gv7w-7c9h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences