Skip to content
Fencer Vulns
medium 6.7

CVE-2021-3719 json

A potential vulnerability in the SMI callback function that saves and restore boot script tables used for resuming from sleep state in some…

published 2021-11-12 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-26999

cvss
6.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 16%
public exploits
0
none known

Summary

A potential vulnerability in the SMI callback function that saves and restore boot script tables used for resuming from sleep state in some ThinkCentre and ThinkStation models may allow an attacker with local access and elevated privileges to execute arbitrary code.

Patch / fix

  • lenovo thinkcentre_m600_firmware m00kt65a
  • lenovo thinkcentre_m700_tiny_firmware fwktb9a
  • lenovo thinkcentre_m73_firmware fhkt86a
  • lenovo thinkcentre_m800_firmware fwktb9a
  • lenovo thinkcentre_m818z_firmware m1ekt23a
  • lenovo thinkcentre_m900_firmware fwktb9a
  • lenovo thinkcentre_m900x_firmware fwktb9a
  • lenovo thinkcentre_m4500q_firmware fhkt86a
  • lenovo thinkcentre_x1_firmware m0hkt50a
  • lenovo thinkstation_p500_firmware a4ktaba
  • lenovo thinkstation_p700_firmware a5ktaba
  • lenovo thinkstation_p900_firmware a6ktaba

Exploit prediction

0.25% chance of exploitation in the next 30 days, higher than 16% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

  • Lenovo ThinkCentre and ThinkStation BIOS

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.