CVE-2021-3718

Severity: medium (CVSS 4.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-11-12 · updated 2026-06-17
Weakness: CWE-232

Description

A denial of service vulnerability was reported in some ThinkPad models that could cause a system to crash when the Enhanced Biometrics setting is enabled in BIOS.

Affected products

Lenovo Thinkpad 11E 3Rd Gen Firmware: through 1.22; through 1.29
Lenovo Thinkpad 11E 4Th Gen Celeron Firmware: through 1.27
Lenovo Thinkpad 11E 4Th Gen I3 Firmware: through 1.22
Lenovo Thinkpad 11E 4Th Gen I5 Firmware: through 1.22
Lenovo Thinkpad 11E 4Th Gen I7 Firmware: through 1.22
Lenovo Thinkpad 11E 5Th Gen Firmware: through 1.13
Lenovo Thinkpad 11E Yoga Gen 6 Firmware: through 1.12
Lenovo Thinkpad 13 Gen 2 Firmware: through 1.29
Lenovo Thinkpad E490 Firmware: through 1.30
Lenovo Thinkpad E490S Firmware: through 1.30
Lenovo Thinkpad E590 Firmware: through 1.30
Lenovo Thinkpad L13 Firmware: through 1.31
Lenovo Thinkpad L13 Gen 2 Firmware: through 1.11; through 1.08
Lenovo Thinkpad L13 Yoga Firmware: through 1.31
Lenovo Thinkpad L13 Yoga Gen 2 Firmware: through 1.11; through 1.08
Lenovo Thinkpad L14 Firmware: before 1.20.1.17 — fixed in 1.20.1.17
Lenovo Thinkpad L14 Gen 1 Firmware: before 1.15 — fixed in 1.15
Lenovo Thinkpad L15 Firmware: before 1.20.1.17 — fixed in 1.20.1.17
Lenovo Thinkpad L15 Gen 1 Firmware: before 1.15 — fixed in 1.15
Lenovo Thinkpad L380 Firmware: through 1.26
Lenovo Thinkpad L380 Yoga Firmware: through 1.26
Lenovo Thinkpad L390 Firmware: through 1.35
Lenovo Thinkpad L390 Yoga Firmware: through 1.35
Lenovo Thinkpad L490 Firmware: before 1.26 — fixed in 1.26
Lenovo Thinkpad L590 Firmware: before 1.26 — fixed in 1.26
Lenovo Thinkpad P43S Firmware: before n2iet96w — fixed in n2iet96w
Lenovo Thinkpad P52 Firmware: before n2cet60w — fixed in n2cet60w
Lenovo Thinkpad P53S Firmware: before n2iet96w — fixed in n2iet96w
Lenovo Thinkpad P72 Firmware: before n2cet60w — fixed in n2cet60w
Lenovo Thinkpad S2 Gen 6 Firmware: through 2021-09-30

How to fix

Upgrade to a fixed version: Lenovo Thinkpad L14 Firmware 1.20.1.17; Lenovo Thinkpad L14 Gen 1 Firmware 1.15; Lenovo Thinkpad L15 Firmware 1.20.1.17; Lenovo Thinkpad L15 Gen 1 Firmware 1.15; Lenovo Thinkpad L490 Firmware 1.26; Lenovo Thinkpad L590 Firmware 1.26; Lenovo Thinkpad P43S Firmware n2iet96w; Lenovo Thinkpad P52 Firmware n2cet60w; Lenovo Thinkpad P53S Firmware n2iet96w; Lenovo Thinkpad P72 Firmware n2cet60w; Lenovo Thinkpad T490 Firmware n2iet96w; Lenovo Thinkpad T590 Firmware n2iet96w. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-3718 or the next vulnerability affects your stack