CVE-2021-3970

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-04-22 · updated 2026-06-17
Weakness: CWE-20

Description

A potential vulnerability in LenovoVariable SMI Handler due to insufficient validation in some Lenovo Notebook models BIOS may allow an attacker with local access and elevated privileges to execute arbitrary code.

Affected products

Lenovo Ideapad 3-14Ada05 Firmware: before e8cn33ww — fixed in e8cn33ww
Lenovo Ideapad 3-14Ada6 Firmware: before hbcn21ww — fixed in hbcn21ww
Lenovo Ideapad 3-14Alc6 Firmware: before glcn43ww — fixed in glcn43ww
Lenovo Ideapad 3-14Are05 Firmware: before dzcn42ww — fixed in dzcn42ww
Lenovo Ideapad 3-14Igl05 Firmware: before emcn52ww — fixed in emcn52ww
Lenovo Ideapad 3-14Iil05 Firmware: before dvcn23ww — fixed in dvcn23ww
Lenovo Ideapad 3-14Iml05 Firmware: before dxcn41ww — fixed in dxcn41ww
Lenovo Ideapad 3-14Itl05 Firmware: before gccn26ww — fixed in gccn26ww
Lenovo Ideapad 3-14Itl6 Firmware: before ggcn33ww — fixed in ggcn33ww
Lenovo Ideapad 3-15Ada05 Firmware: before e8cn33ww — fixed in e8cn33ww
Lenovo Ideapad 3-15Ada6 Firmware: before hbcn21ww — fixed in hbcn21ww
Lenovo Ideapad 3-15Alc6 Firmware: before glcn43ww — fixed in glcn43ww
Lenovo Ideapad 3-15Are05 Firmware: before dzcn42ww — fixed in dzcn42ww
Lenovo Ideapad 3-15Igl05 Firmware: before dvcn23ww — fixed in dvcn23ww
Lenovo Ideapad 3-15Iil05 Firmware: before emcn52ww — fixed in emcn52ww
Lenovo Ideapad 3-15Iml05 Firmware: before dxcn41ww — fixed in dxcn41ww
Lenovo Ideapad 3-15Itl05 Firmware: before gccn26ww — fixed in gccn26ww
Lenovo Ideapad 3-15Itl6 Firmware: before ggcn33ww — fixed in ggcn33ww
Lenovo Ideapad 3-17Ada05 Firmware: before e8cn33ww — fixed in e8cn33ww
Lenovo Ideapad 3-17Ada6 Firmware: before hbcn21ww — fixed in hbcn21ww
Lenovo Ideapad 3-17Alc6 Firmware: before glcn43ww — fixed in glcn43ww
Lenovo Ideapad 3-17Are05 Firmware: before dzcn42ww — fixed in dzcn42ww
Lenovo Ideapad 3-17Iil05 Firmware: before emcn52ww — fixed in emcn52ww
Lenovo Ideapad 3-17Iml05 Firmware: before dxcn41ww — fixed in dxcn41ww
Lenovo Ideapad 3-17Itl6 Firmware: before ggcn33ww — fixed in ggcn33ww
Lenovo Ideapad 5-15Are05 Firmware: before e7cn44ww — fixed in e7cn44ww
Lenovo Ideapad 5-15Iil05 Firmware: before dpcn54ww — fixed in dpcn54ww
Lenovo Ideapad Creator 5-15Imh05 Firmware: before egcn36ww — fixed in egcn36ww
Lenovo Ideapad Gaming 3-15Arh05 Firmware: before fccn17ww — fixed in fccn17ww
Lenovo Ideapad Gaming 3-15Imh05 Firmware: before egcn36ww — fixed in egcn36ww

How to fix

Upgrade to a fixed version: Lenovo Ideapad 3-14Ada05 Firmware e8cn33ww; Lenovo Ideapad 3-14Ada6 Firmware hbcn21ww; Lenovo Ideapad 3-14Alc6 Firmware glcn43ww; Lenovo Ideapad 3-14Are05 Firmware dzcn42ww; Lenovo Ideapad 3-14Igl05 Firmware emcn52ww; Lenovo Ideapad 3-14Iil05 Firmware dvcn23ww; Lenovo Ideapad 3-14Iml05 Firmware dxcn41ww; Lenovo Ideapad 3-14Itl05 Firmware gccn26ww; Lenovo Ideapad 3-14Itl6 Firmware ggcn33ww; Lenovo Ideapad 3-15Ada05 Firmware e8cn33ww; Lenovo Ideapad 3-15Ada6 Firmware hbcn21ww; Lenovo Ideapad 3-15Alc6 Firmware glcn43ww. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-3970 or the next vulnerability affects your stack