CVE-2021-3452

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

A potential vulnerability in the system shutdown SMI callback function in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
LenovoThinkPad BIOSvarious

References

Timeline

Published
Jul 16, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-345208.1Microsoft SharePoint Server Remote Code Execution VulnerabilityCVE-2021-345217.8Raw Image Extension Remote Code Execution VulnerabilityCVE-2021-345227.8Microsoft Defender Remote Code Execution VulnerabilityCVE-2021-345239.0Microsoft Exchange Server Elevation of Privilege VulnerabilityCVE-2021-345248.1Microsoft Dynamics 365 On-Premises Remote Code Execution VulnerabilityCVE-2021-345258.8Windows DNS Server Remote Code Execution VulnerabilityCVE-2021-345278.8A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacCVE-2021-345287.8Visual Studio Code Remote Code Execution VulnerabilityCVE-2021-345297.8Visual Studio Code Remote Code Execution VulnerabilityCVE-2021-34534.6Some Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could allow an attacker wiCVE-2021-345307.8Windows Graphics Component Remote Code Execution VulnerabilityCVE-2021-345325.5ASP.NET Core and Visual Studio Information Disclosure Vulnerability
CVE-2021-3452: Medium severity, CVSS 6.7 | Vulnix