CVE-2021-3453

Severity: medium (CVSS 4.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-07-16 · updated 2026-06-17
Weakness: CWE-693

Description

Some Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could allow an attacker with physical access the ability to write to the SPI flash storage.

Affected products

Lenovo 730S-13Iml Firmware: all versions
Lenovo Ideacentre Aio 5-24Imb05 Firmware: before 2021-09-30 — fixed in 2021-09-30
Lenovo Ideacentre Aio 5-74Imb05 Firmware: before 2021-09-30 — fixed in 2021-09-30
Lenovo Ideapad 1-11Igl05 Firmware: all versions
Lenovo Ideapad 1-14Igl05 Firmware: all versions
Lenovo Ideapad S940-14Iil Firmware: all versions
Lenovo Ideapad S940-14Iwl Firmware: all versions
Lenovo Ideapad Slim 1-11Ast-05 Firmware: all versions
Lenovo Ideapad Slim 1-14Ast-05 Firmware: all versions
Lenovo Thinkpad Helix Firmware: n17etb4w
Lenovo Thinkpad T550 Firmware: n11et53w
Lenovo Thinkpad W550S Firmware: n11et53w
Lenovo Thinkpad X1 Carbon 3Rd Gen Firmware: n14et55w
Lenovo Thinkpad X250 Firmware: n10et62w
Lenovo Thinkpad Yoga 15 Firmware: n19et65w
Lenovo V130-15Igm Firmware: all versions
Lenovo V330-15Ikb Firmware: all versions
Lenovo V330-15Isk Firmware: all versions
Lenovo Yoga S730-13Iml Firmware: all versions
Lenovo Yoga S940-14Iil Firmware: all versions
Lenovo Yoga S940-14Iwl Firmware: all versions

How to fix

Upgrade to a fixed version: Lenovo Ideacentre Aio 5-24Imb05 Firmware 2021-09-30; Lenovo Ideacentre Aio 5-74Imb05 Firmware 2021-09-30. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-3453 or the next vulnerability affects your stack