CVE-2021-3719

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-11-12 · updated 2026-06-17
Weakness: CWE-20

Description

A potential vulnerability in the SMI callback function that saves and restore boot script tables used for resuming from sleep state in some ThinkCentre and ThinkStation models may allow an attacker with local access and elevated privileges to execute arbitrary code.

Affected products

Lenovo Thinkcentre E93 Firmware: before fbktdfa — fixed in fbktdfa
Lenovo Thinkcentre M4500Q Firmware: before fhkt86a — fixed in fhkt86a
Lenovo Thinkcentre M600 Firmware: before m00kt65a — fixed in m00kt65a
Lenovo Thinkcentre M6500T/S Firmware: before fbktdfa — fixed in fbktdfa
Lenovo Thinkcentre M700 Tiny Firmware: before fwktb9a — fixed in fwktb9a
Lenovo Thinkcentre M73 Firmware: before fhkt86a — fixed in fhkt86a
Lenovo Thinkcentre M73P Firmware: before fbktdfa — fixed in fbktdfa
Lenovo Thinkcentre M800 Firmware: before fwktb9a — fixed in fwktb9a
Lenovo Thinkcentre M818Z Firmware: before m1ekt23a — fixed in m1ekt23a
Lenovo Thinkcentre M83 Firmware: before fbktdfa — fixed in fbktdfa
Lenovo Thinkcentre M8500T/S Firmware: before fbktdfa — fixed in fbktdfa
Lenovo Thinkcentre M900 Firmware: before fwktb9a — fixed in fwktb9a
Lenovo Thinkcentre M900X Firmware: before fwktb9a — fixed in fwktb9a
Lenovo Thinkcentre M93 Firmware: before fbktdfa — fixed in fbktdfa
Lenovo Thinkcentre M93P Firmware: before fbktdfa — fixed in fbktdfa
Lenovo Thinkcentre X1 Firmware: before m0hkt50a — fixed in m0hkt50a
Lenovo Thinkstation P300 Firmware: before fbktdfa — fixed in fbktdfa
Lenovo Thinkstation P500 Firmware: before a4ktaba — fixed in a4ktaba
Lenovo Thinkstation P700 Firmware: before a5ktaba — fixed in a5ktaba
Lenovo Thinkstation P900 Firmware: before a6ktaba — fixed in a6ktaba

How to fix

Upgrade to a fixed version: Lenovo Thinkcentre E93 Firmware fbktdfa; Lenovo Thinkcentre M4500Q Firmware fhkt86a; Lenovo Thinkcentre M600 Firmware m00kt65a; Lenovo Thinkcentre M6500T/S Firmware fbktdfa; Lenovo Thinkcentre M700 Tiny Firmware fwktb9a; Lenovo Thinkcentre M73 Firmware fhkt86a; Lenovo Thinkcentre M73P Firmware fbktdfa; Lenovo Thinkcentre M800 Firmware fwktb9a; Lenovo Thinkcentre M818Z Firmware m1ekt23a; Lenovo Thinkcentre M83 Firmware fbktdfa; Lenovo Thinkcentre M8500T/S Firmware fbktdfa; Lenovo Thinkcentre M900 Firmware fwktb9a. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-3719 or the next vulnerability affects your stack