description: A vulnerability was reported in some Lenovo Desktop models that could allow unauthorized access to the boot menu, when the "BIOS Password At Boot Device List" BIOS setting is Yes.
problem types: CWE-287 Improper Authentication
affected:
{
product: Desktop BIOS
vendor: Lenovo
versions:
status: affected, version: various
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: PHYSICAL
availabilityImpact: HIGH
baseScore: 6.4
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
version: 3.1
]
solutions: Update system firmware to the version (or newer) indicated for your model in the Product Impact section of LEN-67440.