CVE-2021-3843

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-11-12 · updated 2026-06-17
Weakness: CWE-20

Description

A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local access and elevated privileges to execute arbitrary code.

Affected products

Lenovo Thinkpad 11E 3Rd Gen Firmware: through 1.22; through 1.29
Lenovo Thinkpad 11E 4Th Gen Celeron Firmware: through 1.27
Lenovo Thinkpad 11E 4Th Gen I3 Firmware: through 1.22
Lenovo Thinkpad 11E 4Th Gen I5 Firmware: through 1.22
Lenovo Thinkpad 11E 4Th Gen I7 Firmware: through 1.22
Lenovo Thinkpad 11E 5Th Gen Firmware: through 1.13
Lenovo Thinkpad 11E Yoga Gen 6 Firmware: through 1.12
Lenovo Thinkpad 13 Gen 2 Firmware: through 1.29
Lenovo Thinkpad L13 Firmware: through 1.31
Lenovo Thinkpad L13 Gen 2 Firmware: through 1.11; through 1.08
Lenovo Thinkpad L13 Yoga Firmware: through 1.31
Lenovo Thinkpad L13 Yoga Gen 2 Firmware: through 1.11; through 1.08
Lenovo Thinkpad L14 Firmware: before 1.20.1.17 — fixed in 1.20.1.17
Lenovo Thinkpad L14 Gen 1 Firmware: before 1.15 — fixed in 1.15
Lenovo Thinkpad L15 Firmware: before 1.20.1.17 — fixed in 1.20.1.17
Lenovo Thinkpad L15 Gen 1 Firmware: before 1.15 — fixed in 1.15
Lenovo Thinkpad L380 Firmware: through 1.26
Lenovo Thinkpad L380 Yoga Firmware: through 1.26
Lenovo Thinkpad L390 Firmware: through 1.35
Lenovo Thinkpad L390 Yoga Firmware: through 1.35
Lenovo Thinkpad S2 Gen 6 Firmware: through 2021-09-30
Lenovo Thinkpad S2 Yoga Gen 6 Firmware: through 2021-09-30
Lenovo Thinkpad S5 2Nd Gen Firmware: through 1.28
Lenovo Thinkpad T460 Firmware: through 1.43.1.11
Lenovo Thinkpad X12 Detachable Gen 1 Firmware: before 1.16 — fixed in 1.16
Lenovo ThinkPad X1 Fold Gen 1: before n2pet50w — fixed in n2pet50w
Lenovo Thinkpad X260 Firmware: through 1.47\/1.15
Lenovo Thinkpad X380 Yoga Firmware: through 1.34
Lenovo Thinkpad X390 Yoga Firmware: before n2let87w — fixed in n2let87w

How to fix

Upgrade to a fixed version: Lenovo Thinkpad L14 Firmware 1.20.1.17; Lenovo Thinkpad L14 Gen 1 Firmware 1.15; Lenovo Thinkpad L15 Firmware 1.20.1.17; Lenovo Thinkpad L15 Gen 1 Firmware 1.15; Lenovo Thinkpad X12 Detachable Gen 1 Firmware 1.16; Lenovo ThinkPad X1 Fold Gen 1 n2pet50w; Lenovo Thinkpad X390 Yoga Firmware n2let87w. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-3843 or the next vulnerability affects your stack