Improper input validation in Lenovo ThinkCentre and ThinkStation BIOS
Priority LOW 29CWE-20Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA.
Summary
A potential vulnerability in the SMI callback function that saves and restore boot script tables used for resuming from sleep state in some ThinkCentre and ThinkStation models may allow an attacker with local access and elevated privileges to execute arbitrary code.
Why it matters now
EPSS 0.00251 16th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Lenovo | ThinkCentre and ThinkStation BIOS | various | — | No fix listed | CNA |
- ThinkCentre and ThinkStation BIOS VendorLenovo Affected various Fixed in — No fix listed CNA
CPE configurations NVD · 40
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:lenovo:thinkcentre_e93_firmware:*:*:*:*:*:*:*:* | before fbktdfa | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkcentre_e93:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkcentre_m600_firmware:*:*:*:*:*:*:*:* | before m00kt65a | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkcentre_m600:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkcentre_m700_tiny_firmware:*:*:*:*:*:*:*:* | before fwktb9a | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkcentre_m700_tiny:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkcentre_m73_firmware:*:*:*:*:*:*:*:* | before fhkt86a | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkcentre_m73:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkcentre_m73p_firmware:*:*:*:*:*:*:*:* | before fbktdfa | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkcentre_m73p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
- cpe:2.3:o:lenovo:thinkcentre_e93_firmware:*:*:*:*:*:*:*:* Versions before fbktdfa Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkcentre_e93:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkcentre_m600_firmware:*:*:*:*:*:*:*:* Versions before m00kt65a Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkcentre_m600:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkcentre_m700_tiny_firmware:*:*:*:*:*:*:*:* Versions before fwktb9a Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkcentre_m700_tiny:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkcentre_m73_firmware:*:*:*:*:*:*:*:* Versions before fhkt86a Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkcentre_m73:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkcentre_m73p_firmware:*:*:*:*:*:*:*:* Versions before fbktdfa Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkcentre_m73p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Show 30 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:lenovo:thinkcentre_m800_firmware:*:*:*:*:*:*:*:* | before fwktb9a | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkcentre_m800:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkcentre_m818z_firmware:*:*:*:*:*:*:*:* | before m1ekt23a | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkcentre_m818z:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkcentre_m83_firmware:*:*:*:*:*:*:*:* | before fbktdfa | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkcentre_m83:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkcentre_m900_firmware:*:*:*:*:*:*:*:* | before fwktb9a | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkcentre_m900:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkcentre_m900x_firmware:*:*:*:*:*:*:*:* | before fwktb9a | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkcentre_m900x:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkcentre_m93_firmware:*:*:*:*:*:*:*:* | before fbktdfa | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkcentre_m93:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkcentre_m93p_firmware:*:*:*:*:*:*:*:* | before fbktdfa | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkcentre_m93p:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkcentre_m4500q_firmware:*:*:*:*:*:*:*:* | before fhkt86a | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkcentre_m4500q:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkcentre_m6500t\/s_firmware:*:*:*:*:*:*:*:* | before fbktdfa | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkcentre_m6500t\/s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkcentre_m8500t\/s_firmware:*:*:*:*:*:*:*:* | before fbktdfa | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkcentre_m8500t\/s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkcentre_x1_firmware:*:*:*:*:*:*:*:* | before m0hkt50a | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkcentre_x1:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkstation_p300_firmware:*:*:*:*:*:*:*:* | before fbktdfa | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkstation_p300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkstation_p500_firmware:*:*:*:*:*:*:*:* | before a4ktaba | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkstation_p500:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkstation_p700_firmware:*:*:*:*:*:*:*:* | before a5ktaba | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkstation_p700:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
| cpe:2.3:o:lenovo:thinkstation_p900_firmware:*:*:*:*:*:*:*:* | before a6ktaba | Vulnerable | Lenovo |
| cpe:2.3:h:lenovo:thinkstation_p900:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Lenovo |
- cpe:2.3:o:lenovo:thinkcentre_m800_firmware:*:*:*:*:*:*:*:* Versions before fwktb9a Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkcentre_m800:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkcentre_m818z_firmware:*:*:*:*:*:*:*:* Versions before m1ekt23a Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkcentre_m818z:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkcentre_m83_firmware:*:*:*:*:*:*:*:* Versions before fbktdfa Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkcentre_m83:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkcentre_m900_firmware:*:*:*:*:*:*:*:* Versions before fwktb9a Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkcentre_m900:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkcentre_m900x_firmware:*:*:*:*:*:*:*:* Versions before fwktb9a Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkcentre_m900x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkcentre_m93_firmware:*:*:*:*:*:*:*:* Versions before fbktdfa Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkcentre_m93:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkcentre_m93p_firmware:*:*:*:*:*:*:*:* Versions before fbktdfa Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkcentre_m93p:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkcentre_m4500q_firmware:*:*:*:*:*:*:*:* Versions before fhkt86a Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkcentre_m4500q:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkcentre_m6500t\/s_firmware:*:*:*:*:*:*:*:* Versions before fbktdfa Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkcentre_m6500t\/s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkcentre_m8500t\/s_firmware:*:*:*:*:*:*:*:* Versions before fbktdfa Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkcentre_m8500t\/s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkcentre_x1_firmware:*:*:*:*:*:*:*:* Versions before m0hkt50a Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkcentre_x1:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkstation_p300_firmware:*:*:*:*:*:*:*:* Versions before fbktdfa Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkstation_p300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkstation_p500_firmware:*:*:*:*:*:*:*:* Versions before a4ktaba Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkstation_p500:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkstation_p700_firmware:*:*:*:*:*:*:*:* Versions before a5ktaba Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkstation_p700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
- cpe:2.3:o:lenovo:thinkstation_p900_firmware:*:*:*:*:*:*:*:* Versions before a6ktaba Vulnerable ·Lenovo
- cpe:2.3:h:lenovo:thinkstation_p900:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Lenovo
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-3719
- 2026-10-03 Alias added: GHSA-rrvf-m2c7-c86r
References
More Lenovo Thinkcentre E93 Firmware vulnerabilities
- TI-2019-04387 ThinkPad T460p and T470p BIOS Tamper Mechanism CVSS 3.1CRITICAL 9.8
- TI-2020-06733 A potential vulnerability in the SMI callback function used in the EEPROM driver in some… CVSS 3.1HIGH 7.8
- TI-2017-02868 Code injection in Lenovo Desktop and Notebook BIOS CVSS 3.0MEDIUM 6.8
- TI-2019-04373 A potential vulnerability in the SMI callback function used in Legacy USB driver using… CVSS 3.1MEDIUM 6.4
- TI-2019-04371 A potential vulnerability in the SMI callback function used in the Legacy USB driver… CVSS 3.1MEDIUM 6.4
- TI-2019-04389 Lenovo was notified of a potential denial of service vulnerability, affecting various… CVSS 3.1MEDIUM 5.5
Sources
- CVE-2021-3719 · CVE Program
- CVE-2021-3719 · NVD
- FIRST EPSS
- GHSA-rrvf-m2c7-c86r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences