CVE-2021-4212

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-04-22 · updated 2026-06-17
Weakness: CWE-20

Description

A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook models may allow an attacker with local access and elevated privileges to execute arbitrary code.

Affected products

Lenovo C340-14Iml Firmware: all versions
Lenovo C340-15Iml Firmware: all versions
Lenovo D330-10Igm Firmware: all versions
Lenovo Duet 3-10Igl5 Firmware: all versions
Lenovo E41-50 Firmware: all versions
Lenovo Flex-14Iml Firmware: all versions
Lenovo Flex-15Iml Firmware: all versions
Lenovo Ideapad 3-14Are05 Firmware: all versions
Lenovo Ideapad 3-15Are05 Firmware: all versions
Lenovo Ideapad 3-17Are05 Firmware: all versions
Lenovo Ideapad 5-14Alc05 Firmware: all versions
Lenovo Ideapad 5-14Are05 Firmware: all versions
Lenovo Ideapad 5-15Itl05 Firmware: all versions
Lenovo Ideapad 5 Pro-14Acn6 Firmware: all versions
Lenovo Ideapad 5 Pro-14Itl6 Firmware: all versions
Lenovo Ideapad 5 Pro-16Ihu6 Firmware: all versions
Lenovo Ideapad Creator 5-15Imh05 Firmware: all versions
Lenovo Ideapad Gaming 3-15Ach6 Firmware: all versions
Lenovo Ideapad Gaming 3-15Arh05 Firmware: all versions
Lenovo Ideapad Gaming 3-15Imh05 Firmware: all versions
Lenovo L340-15Irh Firmware: all versions
Lenovo L340-15Iwl Firmware: all versions
Lenovo L340-15Iwl Touch Firmware: all versions
Lenovo L340-17Irh Firmware: all versions
Lenovo L340-17Iwl Firmware: all versions
Lenovo Legion Y540-15Irh-Pg0 Firmware: all versions
Lenovo Legion Y540-15Irh Firmware: all versions
Lenovo Legion Y540-17Irh-Pg0 Firmware: all versions
Lenovo Legion Y540-17Irh Firmware: all versions
Lenovo Legion Y545-Pg0 Firmware: all versions

References

Get alerted when CVE-2021-4212 or the next vulnerability affects your stack