Skip to content
Fencer Vulns
medium 4.4

CVE-2021-3786 json

A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be use…

published 2021-11-12 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-27048

cvss
4.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 14%
public exploits
0
none known

Summary

A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad systems could be used to leak out data out of the SMRAM range.

Patch / fix

  • lenovo thinkpad_x380_yoga_firmware 2020-10-31
  • lenovo thinkpad_x1_fold_gen_1_firmware 2021-10-29
  • lenovo thinkpad_yoga_260_firmware 2021-10-25
  • lenovo thinkpad_yoga_11e_3rd_gen_firmware 2021-10-31
  • lenovo thinkpad_yoga_15_firmware n19et66w
  • lenovo thinkpad_yoga_370_firmware 2021-10-31
  • lenovo thinkpad_x12_detachable_gen_1_firmware 2021-10-31
  • lenovo thinkpad_x390_firmware n2jet96w
  • lenovo thinkpad_yoga_11e_4th_gen_firmware 2021-10-31
  • lenovo thinkpad_yoga_11e_5th_gen_firmware 2021-10-31
  • lenovo thinkpad_x250_firmware 2021-10-31
  • lenovo thinkpad_x260_firmware 2021-10-31
  • lenovo thinkpad_x390_yoga_firmware n2let87w
  • lenovo thinkpad_x280_firmware n20et58w
  • lenovo thinkpad_x1_titanium_firmware n2met51w
  • lenovo thinkpad_x270_firmware 2021-10-29
  • lenovo thinkpad_x1_carbon_5th_gen_kabylake_firmware n1met66w
  • lenovo thinkpad_x13_gen_1_firmware n2yet31w
  • lenovo thinkpad_x13_gen_2_firmware n35et41w
  • lenovo thinkpad_x13_yoga_gen_1_firmware n2uet56w

Exploit prediction

0.23% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N

Affected products

  • Lenovo Notebook and ThinkPad BIOS

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.