Medium severity6.7NVD Advisory· Published Oct 30, 2023· Updated Jun 17, 2026

CVE-2022-4575

Description

A vulnerability due to improper write protection of UEFI variables was reported in the BIOS of some ThinkPad models could allow an attacker with physical or local access and elevated privileges the ability to bypass Secure Boot.

Affected products

Lenovo/Thinkpad 25 Firmware
cpe:2.3:o:lenovo:thinkpad_25_firmware:*:*:*:*:*:*:*:*
Range: <1.73
Lenovo/Thinkpad L560 Firmware
cpe:2.3:o:lenovo:thinkpad_l560_firmware:*:*:*:*:*:*:*:*
Range: <1.62
Lenovo/Thinkpad P50 Firmware
cpe:2.3:o:lenovo:thinkpad_p50_firmware:*:*:*:*:*:*:*:*
Range: <1.71
Lenovo/Thinkpad P50s Firmware
cpe:2.3:o:lenovo:thinkpad_p50s_firmware:*:*:*:*:*:*:*:*
Range: <1.45
Lenovo/Thinkpad P70 Firmware
cpe:2.3:o:lenovo:thinkpad_p70_firmware:*:*:*:*:*:*:*:*
Range: <2.45
Lenovo/Thinkpad T470 Firmware
cpe:2.3:o:lenovo:thinkpad_t470_firmware:*:*:*:*:*:*:*:*
Range: <1.73
Lenovo/Thinkpad T470s Firmware
cpe:2.3:o:lenovo:thinkpad_t470s_firmware:*:*:*:*:*:*:*:*
Range: <1.49
Lenovo/Thinkpad T560 Firmware
cpe:2.3:o:lenovo:thinkpad_t560_firmware:*:*:*:*:*:*:*:*
Range: <1.45
Lenovo/Thinkpad X1 Carbon 4th Gen Firmware
cpe:2.3:o:lenovo:thinkpad_x1_carbon_4th_gen_firmware:*:*:*:*:*:*:*:*
Range: <1.56
Lenovo/Thinkpad X1 Yoga 1st Gen Firmware
cpe:2.3:o:lenovo:thinkpad_x1_yoga_1st_gen_firmware:*:*:*:*:*:*:*:*
Range: <1.56
Lenovo/Thinkpad X260 Firmware
cpe:2.3:o:lenovo:thinkpad_x260_firmware:*:*:*:*:*:*:*:*
Range: <1.50
Lenovo/Thinkpad X270 Firmware
cpe:2.3:o:lenovo:thinkpad_x270_firmware:*:*:*:*:*:*:*:*
Range: <1.47
Lenovo/Thinkpad Yoga 260 Firmware
cpe:2.3:o:lenovo:thinkpad_yoga_260_firmware:*:*:*:*:*:*:*:*
Range: <1.88
Lenovo/Thinkpadllm-fuzzy
Lenovo/Thinkpad 13e BIOScpe-rescue
Range: various

cvss	0.436
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

CVE-2022-4575

Description

Affected products

Patches

Vulnerability mechanics

References

News mentions