BIOS
by Lenovo
CVEs (33)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2017-3754 | Med | 0.44 | 6.7 | 0.00 | Jul 17, 2017 | Some Lenovo brand notebook systems do not have write protections properly configured in the system BIOS. This could enable an attacker with physical or administrative access to a system to be able to flash the BIOS with an arbitrary image and potentially run malicious BIOS code. | ||
| CVE-2016-8224 | Med | 0.29 | 4.4 | 0.00 | Nov 29, 2016 | A vulnerability has been identified in some Lenovo Notebook and ThinkServer systems where an attacker with administrative privileges on a system could install a program that circumvents Intel Management Engine (ME) protections. This could result in a denial of service or… | ||
| CVE-2023-45079 | 0.00 | — | 0.00 | Nov 8, 2023 | A memory leakage vulnerability was reported in the NvmramSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM variables. | |||
| CVE-2023-45078 | 0.00 | — | 0.00 | Nov 8, 2023 | A memory leakage vulnerability was reported in the DustFilterAlertSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM variables. | |||
| CVE-2023-45077 | 0.00 | — | 0.00 | Nov 8, 2023 | A memory leakage vulnerability was reported in the 534D0740 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables. | |||
| CVE-2023-45076 | 0.00 | — | 0.00 | Nov 8, 2023 | A memory leakage vulnerability was reported in the 534D0140 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables. | |||
| CVE-2023-45075 | 0.00 | — | 0.00 | Nov 8, 2023 | A memory leakage vulnerability was reported in the SWSMI_Shadow DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables. | |||
| CVE-2022-3431 | 0.00 | — | 0.00 | Oct 9, 2023 | A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable. | |||
| CVE-2022-40137 | 0.00 | — | 0.00 | Jan 30, 2023 | A buffer overflow in the WMI SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to execute arbitrary code. | |||
| CVE-2022-40136 | 0.00 | — | 0.00 | Jan 30, 2023 | An information leak vulnerability in SMI Handler used to configure platform settings over WMI in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory. | |||
| CVE-2022-40135 | 0.00 | — | 0.00 | Jan 30, 2023 | An information leak vulnerability in the Smart USB Protection SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory. | |||
| CVE-2022-40134 | 0.00 | — | 0.00 | Jan 30, 2023 | An information leak vulnerability in the SMI Set BIOS Password SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory. | |||
| CVE-2022-3432 | 0.00 | — | 0.00 | Jan 23, 2023 | A potential vulnerability in a driver used during manufacturing process on the Ideapad Y700-14ISK that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable. | |||
| CVE-2022-3430 | 0.00 | — | 0.00 | Jan 23, 2023 | A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable. | |||
| CVE-2022-1892 | 0.00 | — | 0.00 | Jan 23, 2023 | A buffer overflow in the SystemBootManagerDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code. | |||
| CVE-2022-1891 | 0.00 | — | 0.00 | Jan 23, 2023 | A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code. | |||
| CVE-2022-1890 | 0.00 | — | 0.00 | Jan 23, 2023 | A buffer overflow in the ReadyBootDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code. | |||
| CVE-2021-4212 | 0.00 | — | 0.00 | Apr 22, 2022 | A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook models may allow an attacker with local access and elevated privileges to execute arbitrary code. | |||
| CVE-2021-4211 | 0.00 | — | 0.00 | Apr 22, 2022 | A potential vulnerability in the SMI callback function used in the SMBIOS event log driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code. | |||
| CVE-2021-4210 | 0.00 | — | 0.00 | Apr 22, 2022 | A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code. |
- risk 0.44cvss 6.7epss 0.00
Some Lenovo brand notebook systems do not have write protections properly configured in the system BIOS. This could enable an attacker with physical or administrative access to a system to be able to flash the BIOS with an arbitrary image and potentially run malicious BIOS code.
- risk 0.29cvss 4.4epss 0.00
A vulnerability has been identified in some Lenovo Notebook and ThinkServer systems where an attacker with administrative privileges on a system could install a program that circumvents Intel Management Engine (ME) protections. This could result in a denial of service or…
- CVE-2023-45079Nov 8, 2023risk 0.00cvss —epss 0.00
A memory leakage vulnerability was reported in the NvmramSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM variables.
- CVE-2023-45078Nov 8, 2023risk 0.00cvss —epss 0.00
A memory leakage vulnerability was reported in the DustFilterAlertSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM variables.
- CVE-2023-45077Nov 8, 2023risk 0.00cvss —epss 0.00
A memory leakage vulnerability was reported in the 534D0740 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables.
- CVE-2023-45076Nov 8, 2023risk 0.00cvss —epss 0.00
A memory leakage vulnerability was reported in the 534D0140 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables.
- CVE-2023-45075Nov 8, 2023risk 0.00cvss —epss 0.00
A memory leakage vulnerability was reported in the SWSMI_Shadow DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables.
- CVE-2022-3431Oct 9, 2023risk 0.00cvss —epss 0.00
A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
- CVE-2022-40137Jan 30, 2023risk 0.00cvss —epss 0.00
A buffer overflow in the WMI SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to execute arbitrary code.
- CVE-2022-40136Jan 30, 2023risk 0.00cvss —epss 0.00
An information leak vulnerability in SMI Handler used to configure platform settings over WMI in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory.
- CVE-2022-40135Jan 30, 2023risk 0.00cvss —epss 0.00
An information leak vulnerability in the Smart USB Protection SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory.
- CVE-2022-40134Jan 30, 2023risk 0.00cvss —epss 0.00
An information leak vulnerability in the SMI Set BIOS Password SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory.
- CVE-2022-3432Jan 23, 2023risk 0.00cvss —epss 0.00
A potential vulnerability in a driver used during manufacturing process on the Ideapad Y700-14ISK that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
- CVE-2022-3430Jan 23, 2023risk 0.00cvss —epss 0.00
A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
- CVE-2022-1892Jan 23, 2023risk 0.00cvss —epss 0.00
A buffer overflow in the SystemBootManagerDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.
- CVE-2022-1891Jan 23, 2023risk 0.00cvss —epss 0.00
A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.
- CVE-2022-1890Jan 23, 2023risk 0.00cvss —epss 0.00
A buffer overflow in the ReadyBootDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.
- CVE-2021-4212Apr 22, 2022risk 0.00cvss —epss 0.00
A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook models may allow an attacker with local access and elevated privileges to execute arbitrary code.
- CVE-2021-4211Apr 22, 2022risk 0.00cvss —epss 0.00
A potential vulnerability in the SMI callback function used in the SMBIOS event log driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code.
- CVE-2021-4210Apr 22, 2022risk 0.00cvss —epss 0.00
A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an attacker with local access and elevated privileges to execute arbitrary code.
Page 1 of 2