CVE-2021-3718: Lenovo Thinkpad 11e 3rd Gen Firmware

Medium severity, CVSS 4.6. EPSS: 0.2% chance of exploitation in the next 30 days.

A denial of service vulnerability was reported in some ThinkPad models that could cause a system to crash when the Enhanced Biometrics setting is enabled in BIOS.

Affected products

Lenovo Thinkpad 11e 3rd Gen Firmware: up to and including 1.22; up to and including 1.29
Lenovo Thinkpad 11e 4th Gen Celeron Firmware: up to and including 1.27
Lenovo Thinkpad 11e 4th Gen i3 Firmware: up to and including 1.22
Lenovo Thinkpad 11e 4th Gen i5 Firmware: up to and including 1.22
Lenovo Thinkpad 11e 4th Gen i7 Firmware: up to and including 1.22
Lenovo Thinkpad 11e 5th Gen Firmware: up to and including 1.13
Lenovo Thinkpad 11e Yoga Gen 6 Firmware: up to and including 1.12
Lenovo Thinkpad 13 Gen 2 Firmware: up to and including 1.29
Lenovo Thinkpad e490 Firmware: up to and including 1.30
Lenovo Thinkpad e490s Firmware: up to and including 1.30
Lenovo Thinkpad e590 Firmware: up to and including 1.30
Lenovo Thinkpad l13 Firmware: up to and including 1.31
Lenovo Thinkpad l13 Gen 2 Firmware: up to and including 1.11; up to and including 1.08
Lenovo Thinkpad l13 Yoga Firmware: up to and including 1.31
Lenovo Thinkpad l13 Yoga Gen 2 Firmware: up to and including 1.11; up to and including 1.08
Lenovo Thinkpad l14 Firmware: before 1.20.1.17 (fixed in 1.20.1.17)
Lenovo Thinkpad l14 Gen 1 Firmware: before 1.15 (fixed in 1.15)
Lenovo Thinkpad l15 Firmware: before 1.20.1.17 (fixed in 1.20.1.17)
Lenovo Thinkpad l15 Gen 1 Firmware: before 1.15 (fixed in 1.15)
Lenovo Thinkpad l380 Firmware: up to and including 1.26
Lenovo Thinkpad l380 Yoga Firmware: up to and including 1.26
Lenovo Thinkpad l390 Firmware: up to and including 1.35
Lenovo Thinkpad l390 Yoga Firmware: up to and including 1.35
Lenovo Thinkpad l490 Firmware: before 1.26 (fixed in 1.26)
Lenovo Thinkpad l590 Firmware: before 1.26 (fixed in 1.26)
and 14 more

Published 2021-11-12. Last modified 2026-06-17.