CVE-2021-3519

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At Boot Device List" BIOS setting is Yes.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
Lenovo	Desktop BIOS	various

References

https://support.lenovo.com/us/en/product_security/LEN-67440Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-67440Vendor Advisory

Timeline

Published: Nov 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-351937.5Patterson Application Service in Patterson Eaglesoft 18 through 21 accepts the same certificate authentication across different customers' i CVE-2021-351967.8Manuskript through 0.12.0 allows remote attackers to execute arbitrary code via a crafted settings.pickle file in a project file, because th CVE-2021-351977.5In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintended API access. When a CVE-2021-351985.4NETSCOUT nGeniusONE 6.3.0 build 1004 and earlier allows Stored Cross-Site Scripting (XSS) in the Packet Analysis module.CVE-2021-351995.4NETSCOUT nGeniusONE 6.3.0 build 1196 and earlier allows Stored Cross-Site Scripting (XSS) in UploadFile.CVE-2021-35209.8There's a flaw in lz4. An attacker who submits a crafted file to an application linked with lz4 may be able to trigger an integer overflow, CVE-2021-352004.8NETSCOUT nGeniusONE 6.3.0 build 1196 allows high-privileged users to achieve Stored Cross-Site Scripting (XSS) in FDSQueryService.CVE-2021-352016.5NEI in NETSCOUT nGeniusONE 6.3.0 build 1196 allows XML External Entity (XXE) attacks.CVE-2021-352024.3NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Authorization Bypass (to access an endpoint) in FDSQueryService.CVE-2021-352035.7NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Arbitrary File Read operations via the FDSQueryService endpoint.CVE-2021-352045.4NETSCOUT Systems nGeniusONE 6.3.0 build 1196 allows Reflected Cross-Site Scripting (XSS) in the support endpoint.CVE-2021-352055.4NETSCOUT Systems nGeniusONE version 6.3.0 build 1196 allows URL redirection in redirector.