← Vulnerability feed

Vulnerability record · CVE-2021-3599 · published 12 November 2021

CVE-2021-3599: Lenovo thinkpad x380 yoga firmware improper input validation vulnerability

Lenovo · Thinkpad X380 Yoga Firmware

A potential vulnerability in the SMI callback function used to access flash device in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.

6.7 CVSS 3.1 Medium EPSS 0.29% · top 79.8% CWE-20 · Improper input validation
6.7CVSS 3.1 base score, v2 7.2
0.29%EPSS exploitation probability, 30 days
NoNot in CISA KEV
133Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

A potential vulnerability in the SMI callback function used to access flash device in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

133 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://support.lenovo.com/us/en/product_security/LEN-67440 PatchVendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-67440 PatchVendor Advisory

Track CVE-2021-3599 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

6.8CVE-2021-3614Lenovo ideapad 1-11ada05 firmware vulnerabilityA vulnerability was reported on some Lenovo Notebook systems that could allow an attacker with physical access to elevate privileges under certain co…EPSS 0.24%6.7CVE-2021-3843Lenovo thinkpad 11e 3rd gen firmware improper input validation vulnerabilityA potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privilege…EPSS 0.28%5.5CVE-2021-3786Lenovo thinkpad x380 yoga firmware improper input validation vulnerabilityA potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be used to leak …EPSS 0.23%4.6CVE-2021-3718Lenovo thinkpad 11e 3rd gen firmware vulnerabilityA denial of service vulnerability was reported in some ThinkPad models that could cause a system to crash when the Enhanced Biometrics setting is ena…EPSS 0.22%4.6CVE-2021-3453Lenovo thinkpad helix firmware vulnerabilitySome Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could allow an attacker with physic…EPSS 0.24%9.5CVE-2026-88771Citrix netscaler application delivery controller improper input validation vulnerabilityImproper input validation vulnerability in Citrix NetScaler ADC and Citrix NetScaler Gateway. This issue affects ADC: before 14.1-73.37, before 13.1-…KEVEPSS 1.1%9.5CVE-2026-93952Arista velocloud orchestrator improper input validation vulnerabilityVeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality an…KEVEPSS 1.1%8.8CVE-2019-1068Microsoft SQL Server improper input validation remote code executionMicrosoft SQL Server mishandles processing of internal functions, allowing an authenticated remote attacker to execute code on the database server. T…KEVEPSS 57%analysed

Source: NIST National Vulnerability Database (record CVE-2021-3599), CISA KEV, FIRST EPSS (scores of 2026-10-17). This page is refreshed as NVD updates the record.