CVE-2021-3519

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-11-12 · updated 2026-06-17
Weakness: CWE-287

Description

A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At Boot Device List" BIOS setting is Yes.

Affected products

Lenovo Ideacentre 3-07Imb05 Firmware: before m2vkt18a — fixed in m2vkt18a
Lenovo Ideacentre 310S-08Igm Firmware: through m1tkt31a
Lenovo Ideacentre 5-14Imb05 Firmware: before o4hkt33a — fixed in o4hkt33a
Lenovo Ideacentre 5-14Iob6 Firmware: before m3gkt29a — fixed in m3gkt29a
Lenovo Ideacentre 510A-15Arr Firmware: through o4dkt41a
Lenovo Ideacentre 510S-07Icb Firmware: before m22kt46a — fixed in m22kt46a
Lenovo Ideacentre 510S-07Ick Firmware: before m30kt24a; before m30kt23a — fixed in m30kt23a, m30kt24a
Lenovo Ideacentre C5-14Mb05 Firmware: before o4hkt33a — fixed in o4hkt33a
Lenovo Ideacentre Creator 5-14Iob6 Firmware: before m3gkt29a — fixed in m3gkt29a
Lenovo Ideacentre G5-14Imb05 Firmware: before o4hkt33a — fixed in o4hkt33a
Lenovo Ideacentre Gaming 5-14Iob6 Firmware: before m3gkt29a — fixed in m3gkt29a
Lenovo Thinkcentre E75 T/S Firmware: before m16kt67a — fixed in m16kt67a
Lenovo Thinkcentre M60E Tiny Firmware: before m3skt1ea — fixed in m3skt1ea
Lenovo Thinkcentre M630E Firmware: before m28kt36a — fixed in m28kt36a
Lenovo Thinkcentre M70A Firmware: through m2skt21a
Lenovo Thinkcentre M70A Gen 2 Firmware: before m3nkt17a — fixed in m3nkt17a
Lenovo Thinkcentre M70C Firmware: before m2vkt18a — fixed in m2vkt18a
Lenovo Thinkcentre M70Q Firmware: before m2wkt49a — fixed in m2wkt49a
Lenovo Thinkcentre M70S Firmware: before m2tkt3ca — fixed in m2tkt3ca
Lenovo Thinkcentre M70T Firmware: before m2tkt3ca — fixed in m2tkt3ca
Lenovo Thinkcentre M710E Firmware: before m1zkt37a — fixed in m1zkt37a
Lenovo Thinkcentre M710S Firmware: before m16kt67a — fixed in m16kt67a
Lenovo Thinkcentre M710T Firmware: before m16kt67a — fixed in m16kt67a
Lenovo Thinkcentre M720E Firmware: before m30kt23a — fixed in m30kt23a
Lenovo Thinkcentre M75N Firmware: before m33kt21a — fixed in m33kt21a
Lenovo Thinkcentre M75S Gen 2 Firmware: before m3bkt24a; before m3akt35a — fixed in m3akt35a, m3bkt24a
Lenovo Thinkcentre M75T Gen 2 Firmware: before m3bkt24a; before m3akt35a — fixed in m3akt35a, m3bkt24a
Lenovo Thinkcentre M80Q Firmware: before m2wkt49a — fixed in m2wkt49a
Lenovo Thinkcentre M80S Firmware: before m2tkt3ca — fixed in m2tkt3ca
Lenovo Thinkcentre M80T Firmware: before m2tkt3ca — fixed in m2tkt3ca

How to fix

Upgrade to a fixed version: Lenovo Ideacentre 3-07Imb05 Firmware m2vkt18a; Lenovo Ideacentre 5-14Imb05 Firmware o4hkt33a; Lenovo Ideacentre 5-14Iob6 Firmware m3gkt29a; Lenovo Ideacentre 510S-07Icb Firmware m22kt46a; Lenovo Ideacentre 510S-07Ick Firmware m30kt23a, m30kt24a; Lenovo Ideacentre C5-14Mb05 Firmware o4hkt33a; Lenovo Ideacentre Creator 5-14Iob6 Firmware m3gkt29a; Lenovo Ideacentre G5-14Imb05 Firmware o4hkt33a; Lenovo Ideacentre Gaming 5-14Iob6 Firmware m3gkt29a; Lenovo Thinkcentre E75 T/S Firmware m16kt67a; Lenovo Thinkcentre M60E Tiny Firmware m3skt1ea; Lenovo Thinkcentre M630E Firmware m28kt36a. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-3519 or the next vulnerability affects your stack