CVE-2022-4575
6.7
Vector
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Exploitability: 0.8 / Impact: 5.9
Source: NVD
Description
A vulnerability due to improper write protection of UEFI variables was reported in the BIOS of some ThinkPad models could allow an attacker with physical or local access and elevated privileges the ability to bypass Secure Boot.
Affected (13)
Products: Lenovo: Thinkpad 25 Firmware, Thinkpad L560 Firmware, Thinkpad P50 Firmware, Thinkpad P50s Firmware, Thinkpad P70 Firmware, Thinkpad T470 Firmware, Thinkpad T470s Firmware, Thinkpad T560 Firmware, Thinkpad X1 Carbon 4th Gen Firmware, Thinkpad X1 Yoga 1st Gen Firmware, Thinkpad X260 Firmware, Thinkpad X270 Firmware, Thinkpad Yoga 260 Firmware
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Before 1.73 |
| Running on/with | Platform Versions |
|---|---|
Lenovo Thinkpad 25 | All versions |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| Before 1.62 |
| Running on/with | Platform Versions |
|---|---|
Lenovo Thinkpad L560 | All versions |
Configuration C
| Vulnerable Software | Affected Versions |
|---|---|
| Before 1.71 |
| Running on/with | Platform Versions |
|---|---|
Lenovo Thinkpad P50 | All versions |
Configuration D
| Vulnerable Software | Affected Versions |
|---|---|
| Before 1.45 |
| Running on/with | Platform Versions |
|---|---|
Lenovo Thinkpad P50s | All versions |
Configuration E
| Vulnerable Software | Affected Versions |
|---|---|
| Before 2.45 |
| Running on/with | Platform Versions |
|---|---|
Lenovo Thinkpad P70 | All versions |
Configuration F
| Vulnerable Software | Affected Versions |
|---|---|
| Before 1.73 |
| Running on/with | Platform Versions |
|---|---|
Lenovo Thinkpad T470 | All versions |
Configuration G
| Vulnerable Software | Affected Versions |
|---|---|
| Before 1.49 |
| Running on/with | Platform Versions |
|---|---|
Lenovo Thinkpad T470s | All versions |
Configuration H
| Vulnerable Software | Affected Versions |
|---|---|
| Before 1.45 |
| Running on/with | Platform Versions |
|---|---|
Lenovo Thinkpad T560 | All versions |
Configuration I
| Vulnerable Software | Affected Versions |
|---|---|
| Before 1.56 |
| Running on/with | Platform Versions |
|---|---|
Lenovo Thinkpad X1 Carbon 4th Gen | All versions |
Configuration J
| Vulnerable Software | Affected Versions |
|---|---|
| Before 1.56 |
| Running on/with | Platform Versions |
|---|---|
Lenovo Thinkpad X1 Yoga 1st Gen | All versions |
Configuration K
| Vulnerable Software | Affected Versions |
|---|---|
| Before 1.50 |
| Running on/with | Platform Versions |
|---|---|
Lenovo Thinkpad X260 | All versions |
Configuration L
| Vulnerable Software | Affected Versions |
|---|---|
| Before 1.47 |
| Running on/with | Platform Versions |
|---|---|
Lenovo Thinkpad X270 | All versions |
Configuration M
| Vulnerable Software | Affected Versions |
|---|---|
| Before 1.88 |
| Running on/with | Platform Versions |
|---|---|
Lenovo Thinkpad Yoga 260 | All versions |
References (2)
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Timeline
No history available yet.