CVE-2021-3519
MEDIUMCVSS 6.8/10EPSS 0.23%
Last modified
CVE-2021-3519 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At Boot Device List" BIOS setting is Yes.. EPSS estimates a 0.23% chance of exploitation in the next 30 days.
Description
A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At Boot Device List" BIOS setting is Yes.
Metrics
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Lenovo | Ideacentre C5-14mb05 Firmware | < o4hkt33a |
| Lenovo | Ideacentre 3-07imb05 Firmware | < m2vkt18a |
| Lenovo | Ideacentre 5-14imb05 Firmware | < o4hkt33a |
| Lenovo | Ideacentre 5-14iob6 Firmware | < m3gkt29a |
| Lenovo | Ideacentre Creator 5-14iob6 Firmware | < m3gkt29a |
| Lenovo | Ideacentre G5-14imb05 Firmware | < o4hkt33a |
| Lenovo | Ideacentre Gaming 5-14iob6 Firmware | < m3gkt29a |
| Lenovo | Thinkcentre M60e Tiny Firmware | < m3skt1ea |
| Lenovo | Thinkcentre M630e Firmware | < m28kt36a |
| Lenovo | Thinkcentre M70a Firmware | <= m2skt21a |
| Lenovo | Thinkcentre M70s Firmware | < m2tkt3ca |
| Lenovo | Thinkcentre M70t Firmware | < m2tkt3ca |
| Lenovo | Thinkcentre M710e Firmware | < m1zkt37a |
| Lenovo | Thinkcentre M710s Firmware | < m16kt67a |
| Lenovo | Thinkcentre M710t Firmware | < m16kt67a |
| Lenovo | Thinkcentre M720e Firmware | < m30kt23a |
| Lenovo | Thinkcentre M75n Firmware | < m33kt21a |
| Lenovo | Thinkcentre M75s Gen 2 Firmware | < m3bkt24a |
| Lenovo | Thinkcentre M70a Gen 2 Firmware | < m3nkt17a |
| Lenovo | Thinkcentre M70c Firmware | < m2vkt18a |
| Lenovo | Thinkcentre M70q Firmware | < m2wkt49a |
| Lenovo | Thinkcentre M75s Gen 2 Firmware | < m3akt35a |
| Lenovo | Thinkcentre M75t Gen 2 Firmware | < m3bkt24a |
| Lenovo | Thinkcentre M75t Gen 2 Firmware | < m3akt35a |
| Lenovo | Thinkcentre M80q Firmware | < m2wkt49a |
| Lenovo | Thinkcentre M80s Firmware | < m2tkt3ca |
| Lenovo | Thinkcentre M80t Firmware | < m2tkt3ca |
| Lenovo | Thinkcentre M810z Firmware | < m1ckt47a |
| Lenovo | Thinkcentre M820z Firmware | < m1nkt57a |
| Lenovo | Thinkcentre M90a Firmware | < m2rkt47a |
| Lenovo | Thinkcentre M90q Tiny Firmware | < m2wkt49a |
| Lenovo | Thinkcentre M90s Firmware | < m2tkt3ca |
| Lenovo | Thinkcentre M90t Firmware | < m2tkt3ca |
| Lenovo | Thinkcentre Qt M410 Firmware | < m16kt67a |
| Lenovo | Thinkcentre Qt B415 Firmware | < m16kt67a |
| Lenovo | Thinkcentre Qt M415 Firmware | < m16kt67a |
| Lenovo | Thinkcentre E75 T\/S Firmware | < m16kt67a |
| Lenovo | Ideacentre 310s-08igm Firmware | <= m1tkt31a |
| Lenovo | Ideacentre 510a-15arr Firmware | <= o4dkt41a |
| Lenovo | Ideacentre 510s-07icb Firmware | < m22kt46a |
| Lenovo | Ideacentre 510s-07ick Firmware | < m30kt24a |
| Lenovo | Ideacentre 510s-07ick Firmware | < m30kt23a |
| Lenovo | V30a-22iml Firmware | < m37kt26a |
| Lenovo | V330 Firmware | <= m1tkt32a |
| Lenovo | V50a-24imb Firmware | < m36kt27a |
| Lenovo | V50s-07imb Firmware | < m2vkt18a |
| Lenovo | V50a-22imb Firmware | < m36kt27a |
| Lenovo | V50t-13imb Firmware | < o4hkt33a |
| Lenovo | V50t-13imb G2 Firmware | < m3gkt29a |
| Lenovo | V520 Firmware | < m16kt67a |
Showing 50 of 62 affected configurations. See NVD for the full list.
References
- https://support.lenovo.com/us/en/product_security/LEN-67440Vendor Advisory
- https://support.lenovo.com/us/en/product_security/LEN-67440Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2021-3519?
A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At Boot Device List" BIOS setting is Yes.
How severe is CVE-2021-3519?
CVE-2021-3519 has a CVSS score of 6.8/10 (MEDIUM severity). The EPSS model estimates a 0.23% probability of exploitation in the next 30 days.
How do I fix CVE-2021-3519?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2021
- CVE-2021-35135A null pointer dereference may potentially occur during RSA …5.5
- CVE-2021-3514When using a sync_repl client in 389-ds-base, an authenticat…6.5
- CVE-2021-3515A shell injection flaw was found in pglogical in versions be…6.7
- CVE-2021-3516There's a flaw in libxml2's xmllint in versions before 2.9.1…7.8
- CVE-2021-3517There is a flaw in the xml entity encoding functionality of …8.6
- CVE-2021-3518There's a flaw in libxml2 in versions before 2.9.11. An atta…8.8
- CVE-2021-35193Patterson Application Service in Patterson Eaglesoft 18 thro…7.5
- CVE-2021-35196Manuskript through 0.12.0 allows remote attackers to execute…7.8
- CVE-2021-35197In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.…7.5
- CVE-2021-35198NETSCOUT nGeniusONE 6.3.0 build 1004 and earlier allows Stor…5.4
- CVE-2021-35199NETSCOUT nGeniusONE 6.3.0 build 1196 and earlier allows Stor…5.4
- CVE-2021-3520There's a flaw in lz4. An attacker who submits a crafted fil…9.8
Are you affected by CVE-2021-3519?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST