How severe is CVE-2021-3614?

CVE-2021-3614 has a CVSS 3.x base score of 6.4, rated medium severity. It is exploitable over physical access with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2021-3614 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-3614?

CVE-2021-3614 primarily affects Lenovo Ideapad 1-11ada05 Firmware. In total, 21 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2021-3614?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2021-3614 published?

CVE-2021-3614 was published on 2021-07-16 and last updated on 2026-06-17.

CVE-2021-3614

CVE-2021-3614 is a medium-severity vulnerability in Lenovo Ideapad 1-11ada05 Firmware with a CVSS 3.x base score of 6.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-636.

Key facts

Severity: Medium (CVSS 3.x base score 6.4)
CVSS v2: 4.4
EPSS exploit prediction: 0% (15th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-636
Affected product: Lenovo Ideapad 1-11ada05 Firmware
Published: 2021-07-16
Last modified: 2026-06-17

Description

A vulnerability was reported on some Lenovo Notebook systems that could allow an attacker with physical access to elevate privileges under certain conditions during a BIOS update performed by Lenovo Vantage.

Frequently asked questions

What is CVE-2021-3614?: A vulnerability was reported on some Lenovo Notebook systems that could allow an attacker with physical access to elevate privileges under certain conditions during a BIOS update performed by Lenovo Vantage.
How severe is CVE-2021-3614?: CVE-2021-3614 has a CVSS 3.x base score of 6.4, rated medium severity. It is exploitable over physical access with low attack complexity, requires low privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2021-3614 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (15th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-3614?: CVE-2021-3614 primarily affects Lenovo Ideapad 1-11ada05 Firmware. In total, 21 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2021-3614?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2021-3614 published?: CVE-2021-3614 was published on 2021-07-16 and last updated on 2026-06-17.

References

https://support.lenovo.com/us/en/product_security/LEN-65529

Affected products (21)

cpe:2.3:o:lenovo:ideapad_1-11ada05_firmware:fqcn19ww:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:ideapad_1-14ada05_firmware:fqcn19ww:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:v130-15ikb_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:100e_2nd_gen_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:300e_2nd_gen_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:ideapad_730-13iml_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:ideapad_flex_5-14alc05_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:ideapad_flex_5-15alc05_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:ideapad_1-11igl05_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:ideapad_1-14igl05_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:ideapad_s940-14iil_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:ideapad_s940-14iwl_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:ideapad_slim_1-11ast-05_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:ideapad_slim_1-14ast-05_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:v130-15igm_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:v330-15ikb_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:v330-15isk_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:ideapad_yoga_c940-15irh_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:ideapad_yoga_s730-13iml_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:ideapad_yoga_s940-14iil_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:ideapad_yoga_s940-14iwl_firmware:-:*:*:*:*:*:*:*

More vulnerabilities in Lenovo Ideapad 1-11ada05 Firmware

CVE-2023-4028 — Medium (CVSS 6.7): A buffer overflow has been identified in the SystemUserMasterHddPwdDxe driver in some Lenovo Notebook products which…
CVE-2022-1892 — Medium (CVSS 6.7): A buffer overflow in the SystemBootManagerDxe driver in some Lenovo Notebook products may allow an attacker with local…

All CVEs affecting Lenovo Ideapad 1-11ada05 Firmware →

Other CWE-636 vulnerabilities

CVE-2026-22034 — Critical (CVSS 9.8): Snuffleupagus is a module that raises the cost of attacks against website by killing bug classes and providing a…
CVE-2024-3729 — Critical (CVSS 9.8): The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to improper missing encryption exception handling…
CVE-2026-40525 — Critical (CVSS 9.1): OpenViking prior to version 0.3.9 contains an authentication bypass vulnerability in the VikingBot OpenAPI HTTP route…
CVE-2024-43532 — High (CVSS 8.8): Remote Registry Service Elevation of Privilege Vulnerability
CVE-2025-54870 — High (CVSS 8.7): VTun-ng is a Virtual Tunnel over TCP/IP network. In versions 3.0.17 and below, failure to initialize encryption modules…
CVE-2026-54762 — High (CVSS 8.6): Traefik is an HTTP reverse proxy and load balancer. From 3.7.0-ea.1 until 3.7.5, there is a medium severity…

Browse all CWE-636 vulnerabilities →