← Vulnerability feed

Vulnerability record · CVE-2021-3971 · published 22 April 2022

CVE-2021-3971: Lenovo ideapad 3-14ada05 firmware vulnerability

Lenovo · Ideapad 3 14ada05 Firmware

A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook devices that was mistakenly included in the BIOS image could allow an attacker with elevated privileges to modify firmware protection region by modifying an NVRAM variable.

6.7 CVSS 3.1 Medium EPSS 1.2% · top 31.6% CWE-489 · CWE-489
6.7CVSS 3.1 base score, v2 4.6
1.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
73Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook devices that was mistakenly included in the BIOS image could allow an attacker with elevated privileges to modify firmware protection region by modifying an NVRAM variable.

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

73 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://support.lenovo.com/us/en/product_security/LEN-73440 Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-73440 Vendor Advisory

Track CVE-2021-3971 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.8CVE-2022-1892Lenovo 100e 2nd gen firmware heap-based buffer overflow vulnerabilityA buffer overflow in the SystemBootManagerDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrar…EPSS 0.34%6.7CVE-2022-3742Lenovo ideapad 1 14iau7 firmware classic buffer overflow vulnerabilityA potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privil…EPSS 0.19%6.7CVE-2022-3746Lenovo ideapad 1 14iau7 firmware improper access control vulnerabilityA potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privil…EPSS 0.17%6.7CVE-2022-3744Lenovo ideapad 1 14iau7 firmware hard-coded credentials vulnerabilityA potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privil…EPSS 0.17%6.7CVE-2021-4212Lenovo c340-14iml firmware improper input validation vulnerabilityA potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook models may allow an attacker with …EPSS 0.26%6.7CVE-2021-3970Lenovo ideapad 3-14ada05 firmware improper input validation vulnerabilityA potential vulnerability in LenovoVariable SMI Handler due to insufficient validation in some Lenovo Notebook models BIOS may allow an attacker with…EPSS 1.3%6.7CVE-2021-3972Lenovo ideapad 3-14ada05 firmware vulnerabilityA potential vulnerability by a driver used during manufacturing process on some consumer Lenovo Notebook devices' BIOS that was mistakenly not deacti…EPSS 2.8%4.4CVE-2022-3745Lenovo ideapad 1 14iau7 firmware information exposure vulnerabilityA potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevated privil…EPSS 0.18%

Source: NIST National Vulnerability Database (record CVE-2021-3971), CISA KEV, FIRST EPSS (scores of 2026-10-18). This page is refreshed as NVD updates the record.