Skip to content
Fencer Intel
medium 6.7

CVE-2021-3971 json

A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook devices that was mistakenl…

published 4y ago modified 4mo ago also EUVD-2021-27176

cvss
6.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 69%
public exploits
0
none known

Summary

A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook devices that was mistakenly included in the BIOS image could allow an attacker with elevated privileges to modify firmware protection region by modifying an NVRAM variable.

Patch / fix

  • lenovo ideapad_3-14ada05_firmware e8cn33ww
  • lenovo ideapad_3-14ada6_firmware hbcn21ww
  • lenovo ideapad_3-14alc6_firmware glcn43ww
  • lenovo ideapad_3-14are05_firmware dzcn42ww
  • lenovo ideapad_3-15ada6_firmware hbcn21ww
  • lenovo ideapad_3-15alc6_firmware glcn43ww
  • lenovo ideapad_3-15are05_firmware dzcn42ww
  • lenovo ideapad_3-15igl05_firmware dvcn23ww
  • lenovo ideapad_3-17ada05_firmware e8cn33ww
  • lenovo ideapad_3-17ada6_firmware hbcn21ww
  • lenovo ideapad_3-17alc6_firmware glcn43ww
  • lenovo ideapad_3-17are05_firmware dzcn42ww
  • lenovo ideapad_3-17iil05_firmware emcn52ww
  • lenovo ideapad_3-15ada05_firmware e8cn33ww
  • lenovo l3-15itl6_firmware gfcn23ww
  • lenovo l340-15irh_firmware bgcn35ww
  • lenovo l340-15iwl_firmware atcn46ww
  • lenovo l340-15iwl_touch_firmware atcn46ww
  • lenovo l340-17irh_firmware bgcn35ww
  • lenovo l340-17iwl_firmware atcn46ww

Is CVE-2021-3971 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

1.24% chance of exploitation in the next 30 days, higher than 69% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P

Affected products

  • Lenovo Notebook BIOS

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.