What’s Vulnerable › Vulnerabilities

CVE-2021-3971

• Severity: medium (CVSS 6.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-04-22 · updated 2026-06-17
• Weakness: CWE-489

Description

A potential vulnerability by a driver used during older manufacturing processes on some consumer Lenovo Notebook devices that was mistakenly included in the BIOS image could allow an attacker with elevated privileges to modify firmware protection region by modifying an NVRAM variable.

Affected products

• Lenovo Ideapad 3-14Ada05 Firmware: before e8cn33ww — fixed in e8cn33ww
• Lenovo Ideapad 3-14Ada6 Firmware: before hbcn21ww — fixed in hbcn21ww
• Lenovo Ideapad 3-14Alc6 Firmware: before glcn43ww — fixed in glcn43ww
• Lenovo Ideapad 3-14Are05 Firmware: before dzcn42ww — fixed in dzcn42ww
• Lenovo Ideapad 3-14Igl05 Firmware: before emcn52ww — fixed in emcn52ww
• Lenovo Ideapad 3-14Iil05 Firmware: before dvcn23ww — fixed in dvcn23ww
• Lenovo Ideapad 3-15Ada05 Firmware: before e8cn33ww — fixed in e8cn33ww
• Lenovo Ideapad 3-15Ada6 Firmware: before hbcn21ww — fixed in hbcn21ww
• Lenovo Ideapad 3-15Alc6 Firmware: before glcn43ww — fixed in glcn43ww
• Lenovo Ideapad 3-15Are05 Firmware: before dzcn42ww — fixed in dzcn42ww
• Lenovo Ideapad 3-15Igl05 Firmware: before dvcn23ww — fixed in dvcn23ww
• Lenovo Ideapad 3-15Iil05 Firmware: before emcn52ww — fixed in emcn52ww
• Lenovo Ideapad 3-17Ada05 Firmware: before e8cn33ww — fixed in e8cn33ww
• Lenovo Ideapad 3-17Ada6 Firmware: before hbcn21ww — fixed in hbcn21ww
• Lenovo Ideapad 3-17Alc6 Firmware: before glcn43ww — fixed in glcn43ww
• Lenovo Ideapad 3-17Are05 Firmware: before dzcn42ww — fixed in dzcn42ww
• Lenovo Ideapad 3-17Iil05 Firmware: before emcn52ww — fixed in emcn52ww
• Lenovo Ideapad 5-15Are05 Firmware: before e7cn44ww — fixed in e7cn44ww
• Lenovo Ideapad Creator 5-15Imh05 Firmware: before egcn36ww — fixed in egcn36ww
• Lenovo Ideapad Gaming 3-15Arh05 Firmware: before fccn17ww — fixed in fccn17ww
• Lenovo Ideapad Gaming 3-15Imh05 Firmware: before egcn36ww — fixed in egcn36ww
• Lenovo L3-15Itl6 Firmware: before gfcn23ww — fixed in gfcn23ww
• Lenovo L340-15Irh Firmware: before bgcn35ww — fixed in bgcn35ww
• Lenovo L340-15Iwl Firmware: before atcn46ww — fixed in atcn46ww
• Lenovo L340-15Iwl Touch Firmware: before atcn46ww — fixed in atcn46ww
• Lenovo L340-17Irh Firmware: before bgcn35ww — fixed in bgcn35ww
• Lenovo L340-17Iwl Firmware: before atcn46ww — fixed in atcn46ww
• Lenovo Legion 5-15Ach6 Firmware: before hhcn25ww — fixed in hhcn25ww
• Lenovo Legion 5-15Ach6A Firmware: before g9cn28ww — fixed in g9cn28ww
• Lenovo Legion 5-15Ach6H Firmware: before gkcn51ww — fixed in gkcn51ww

How to fix

Upgrade to a fixed version: Lenovo Ideapad 3-14Ada05 Firmware e8cn33ww; Lenovo Ideapad 3-14Ada6 Firmware hbcn21ww; Lenovo Ideapad 3-14Alc6 Firmware glcn43ww; Lenovo Ideapad 3-14Are05 Firmware dzcn42ww; Lenovo Ideapad 3-14Igl05 Firmware emcn52ww; Lenovo Ideapad 3-14Iil05 Firmware dvcn23ww; Lenovo Ideapad 3-15Ada05 Firmware e8cn33ww; Lenovo Ideapad 3-15Ada6 Firmware hbcn21ww; Lenovo Ideapad 3-15Alc6 Firmware glcn43ww; Lenovo Ideapad 3-15Are05 Firmware dzcn42ww; Lenovo Ideapad 3-15Igl05 Firmware dvcn23ww; Lenovo Ideapad 3-15Iil05 Firmware emcn52ww. Check the vendor advisory for mitigations.

References

• https://support.lenovo.com/us/en/product_security/LEN-73440
• https://support.lenovo.com/us/en/product_security/LEN-73440

Get alerted when CVE-2021-3971 or the next vulnerability affects your stack