medium6.7
CVE-2021-3972
A potential vulnerability by a driver used during manufacturing process on some consumer Lenovo Notebook devices' BIOS that was mistakenly not deactivated may …
Impact
A potential vulnerability by a driver used during manufacturing process on some consumer Lenovo Notebook devices' BIOS that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Lenovo | Ideapad 3-14ada05 Firmware | before e8cn33ww |
| Lenovo | Ideapad 3-14ada6 Firmware | before hbcn21ww |
| Lenovo | Ideapad 3-14alc6 Firmware | before glcn43ww |
| Lenovo | Ideapad 3-14are05 Firmware | before dzcn42ww |
| Lenovo | Ideapad 3-15ada6 Firmware | before hbcn21ww |
| Lenovo | Ideapad 3-15alc6 Firmware | before glcn43ww |
| Lenovo | Ideapad 3-15are05 Firmware | before dzcn42ww |
| Lenovo | Ideapad 3-15igl05 Firmware | before dvcn23ww |
| Lenovo | Ideapad 3-17ada05 Firmware | before e8cn33ww |
| Lenovo | Ideapad 3-17ada6 Firmware | before hbcn21ww |
| Lenovo | Ideapad 3-17alc6 Firmware | before glcn43ww |
| Lenovo | Ideapad 3-17are05 Firmware | before dzcn42ww |