CVE-2021-3843

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
Lenovo	ThinkPad BIOS	various

References

https://support.lenovo.com/us/en/product_security/LEN-72619Vendor Advisory
https://support.lenovo.com/us/en/product_security/LEN-72619Vendor Advisory

Timeline

Published: Nov 12, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-384307.8FATEK Automation WinProladder versions 3.30 and prior proper validation of user-supplied data when parsing project files, which could result CVE-2021-384314.3An authenticated user using Advantech WebAccess SCADA in versions 9.0.3 and prior can use API functions to disclose project names and paths CVE-2021-384329.8FATEK Automation Communication Server Versions 1.13 and prior lacks proper validation of user-supplied data, which could result in a stack-b CVE-2021-384337.8RTI Connext DDS Professional and Connext DDS Secure Versions 4.2x to 6.1.0 vulnerable to a stack-based buffer overflow, which may allow a lo CVE-2021-384347.8FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could CVE-2021-384359.8RTI Connext DDS Professional and Connext DDS Secure Versions 4.2x to 6.1.0 not correctly calculate the size when allocating the buffer, whic CVE-2021-384367.8FATEK Automation WinProladder versions 3.30 and prior lacks proper validation of user-supplied data when parsing project files, which could CVE-2021-384387.8A use after free vulnerability in FATEK Automation WinProladder versions 3.30 and prior may be exploited when a valid user opens a malformed CVE-2021-384399.8All versions of GurumDDS are vulnerable to heap-based buffer overflow, which may cause a denial-of-service condition or remotely execute arb CVE-2021-38445.4Rapid7 InsightVM suffers from insufficient session expiration when an administrator performs a security relevant edit on an existing, logged CVE-2021-384403.3FATEK Automation WinProladder versions 3.30 and prior is vulnerable to an out-of-bounds read, which may allow an attacker to read unauthoriz CVE-2021-384419.8Eclipse CycloneDDS versions prior to 0.8.0 are vulnerable to a write-what-where condition, which may allow an attacker to write arbitrary va