How severe is CVE-2021-3718?

CVE-2021-3718 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over physical access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2021-3718 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (11th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2021-3718?

CVE-2021-3718 primarily affects Lenovo Thinkpad 11e 3rd Gen Firmware. In total, 42 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2021-3718?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2021-3718 published?

CVE-2021-3718 was published on 2021-11-12 and last updated on 2026-06-17.

CVE-2021-3718

CVE-2021-3718 is a medium-severity vulnerability in Lenovo Thinkpad 11e 3rd Gen Firmware with a CVSS 3.x base score of 4.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-232.

Key facts

Severity: Medium (CVSS 3.x base score 4.3)
CVSS v2: 4.7
EPSS exploit prediction: 0% (11th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-232
Affected product: Lenovo Thinkpad 11e 3rd Gen Firmware
Published: 2021-11-12
Last modified: 2026-06-17

Description

A denial of service vulnerability was reported in some ThinkPad models that could cause a system to crash when the Enhanced Biometrics setting is enabled in BIOS.

Frequently asked questions

What is CVE-2021-3718?: A denial of service vulnerability was reported in some ThinkPad models that could cause a system to crash when the Enhanced Biometrics setting is enabled in BIOS.
How severe is CVE-2021-3718?: CVE-2021-3718 has a CVSS 3.x base score of 4.3, rated medium severity. It is exploitable over physical access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2021-3718 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (11th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2021-3718?: CVE-2021-3718 primarily affects Lenovo Thinkpad 11e 3rd Gen Firmware. In total, 42 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2021-3718?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2021-3718 published?: CVE-2021-3718 was published on 2021-11-12 and last updated on 2026-06-17.

References

https://support.lenovo.com/us/en/product_security/LEN-72619

Affected products (42)

cpe:2.3:o:lenovo:thinkpad_11e_3rd_gen_firmware:*:*:*:*:braswell:*:*:*
cpe:2.3:o:lenovo:thinkpad_11e_3rd_gen_firmware:*:*:*:*:skylate:*:*:*
cpe:2.3:o:lenovo:thinkpad_11e_4th_gen_i3_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_11e_4th_gen_i7_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_11e_4th_gen_i5_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_11e_4th_gen_celeron_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_11e_yoga_gen_6_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_13_gen_2_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_e490_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_e490s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_e590_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_l13_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_l13_gen_2_firmware:*:*:*:*:non-vpro:*:*:*
cpe:2.3:o:lenovo:thinkpad_l13_gen_2_firmware:*:*:*:*:vpro:*:*:*
cpe:2.3:o:lenovo:thinkpad_l13_yoga_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_l13_yoga_gen_2_firmware:*:*:*:*:non-vpro:*:*:*
cpe:2.3:o:lenovo:thinkpad_l13_yoga_gen_2_firmware:*:*:*:*:vpro:*:*:*
cpe:2.3:o:lenovo:thinkpad_l14_gen_1_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_l14_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_l15_gen_1_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_l15_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_l380_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_l380_yoga_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_l390_yoga_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_l390_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_l490_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_l590_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_p43s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_p52_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_p53s_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_p72_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_s5_2nd_gen_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_t460_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_t490_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_t590_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_s2_gen_6_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_s2_yoga_gen_6_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_x12_detachable_gen_1_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_x260_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:lenovo:thinkpad_x380_yoga_firmware:*:*:*:*:*:*:*:*

More vulnerabilities in Lenovo Thinkpad 11e 3rd Gen Firmware

CVE-2021-3843 — Medium (CVSS 6.7): A potential vulnerability in the SMI function to access EEPROM in some ThinkPad models may allow an attacker with local…
CVE-2021-3599 — Medium (CVSS 6.7): A potential vulnerability in the SMI callback function used to access flash device in some ThinkPad models may allow an…
CVE-2021-3786 — Medium (CVSS 4.4): A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and ThinkPad…

All CVEs affecting Lenovo Thinkpad 11e 3rd Gen Firmware →

Other CWE-232 vulnerabilities

CVE-2025-20192 — High (CVSS 7.7): A vulnerability in the Internet Key Exchange version 1 (IKEv1) implementation of Cisco IOS XE Software could allow an…
CVE-2025-40775 — High (CVSS 7.5): When an incoming DNS protocol message includes a Transaction Signature (TSIG), BIND always checks it. If the TSIG…
CVE-2023-39915 — High (CVSS 7.5): NLnet Labs' Routinator up to and including version 0.12.1 may crash when trying to parse certain malformed RPKI…
CVE-2023-39914 — High (CVSS 7.5): NLnet Labs' bcder library up to and including version 0.7.2 panics while decoding certain invalid input data rather…
CVE-2023-2968 — High (CVSS 7.5): A remote attacker can trigger a denial of service in the socket.remoteAddress variable, by sending a crafted HTTP…
CVE-2025-20314 — Medium (CVSS 6.7): A vulnerability in Cisco IOS XE Software could allow an authenticated, local attacker with level-15 privileges or an…

Browse all CWE-232 vulnerabilities →