Bios (Lenovo) - vulnerabilities (CVEs)

32 CVEs, 0 in the last 30 days, 4 known versions, newest CVE from 2024-04-05. Vendor: Lenovo.

CVEs of Bios

CVE-2023-25493 - CVSS 6.7 (medium), 2024-04-05: A potential vulnerability was reported in the BIOS update tool driver for some Desktop, Smart Edge, Smart Office, and ThinkStation products that could allow a…
CVE-2023-45079 - CVSS 6.7 (medium), 2023-11-08: A memory leakage vulnerability was reported in the NvmramSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM variables.
CVE-2023-45078 - CVSS 6.7 (medium), 2023-11-08: A memory leakage vulnerability was reported in the DustFilterAlertSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM…
CVE-2023-45077 - CVSS 6.7 (medium), 2023-11-08: A memory leakage vulnerability was reported in the 534D0740 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables.
CVE-2023-45076 - CVSS 6.7 (medium), 2023-11-08: A memory leakage vulnerability was reported in the 534D0140 DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables.
CVE-2023-45075 - CVSS 6.7 (medium), 2023-11-08: A memory leakage vulnerability was reported in the SWSMI_Shadow DXE driver that may allow a local attacker with elevated privileges to write to NVRAM variables.
CVE-2022-3431 - CVSS 7.8 (high), 2023-10-09: A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow…
CVE-2022-40136 - CVSS 4.4 (medium), 2023-01-30: An information leak vulnerability in SMI Handler used to configure platform settings over WMI in some Lenovo models may allow an attacker with local access…
CVE-2022-40135 - CVSS 4.4 (medium), 2023-01-30: An information leak vulnerability in the Smart USB Protection SMI Handler in some Lenovo models may allow an attacker with local access and elevated…
CVE-2022-40134 - CVSS 4.4 (medium), 2023-01-30: An information leak vulnerability in the SMI Set BIOS Password SMI Handler in some Lenovo models may allow an attacker with local access and elevated…
CVE-2022-40137 - CVSS 6.7 (medium), 2023-01-30: A buffer overflow in the WMI SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to execute arbitrary code.
CVE-2022-3432 - CVSS 6.7 (medium), 2023-01-26: A potential vulnerability in a driver used during manufacturing process on the Ideapad Y700-14ISK that was mistakenly not deactivated may allow an attacker…
CVE-2022-1892 - CVSS 7.8 (high), 2023-01-26: A buffer overflow in the SystemBootManagerDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.
CVE-2022-1891 - CVSS 7.8 (high), 2023-01-26: A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.
CVE-2022-1890 - CVSS 7.8 (high), 2023-01-26: A buffer overflow in the ReadyBootDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code.
CVE-2022-3430 - CVSS 6.7 (medium), 2023-01-23: A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure…
CVE-2021-4211 - CVSS 6.7 (medium), 2022-04-22: A potential vulnerability in the SMI callback function used in the SMBIOS event log driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may…
CVE-2021-4212 - CVSS 6.7 (medium), 2022-04-22: A potential vulnerability in the SMI callback function used in the Legacy BIOS mode driver in some Lenovo Notebook models may allow an attacker with local…
CVE-2021-4210 - CVSS 6.7 (medium), 2022-04-22: A potential vulnerability in the SMI callback function used in the NVME driver in some Lenovo Desktop, ThinkStation, and ThinkEdge models may allow an…
CVE-2021-3452 - CVSS 6.7 (medium), 2021-07-16: A potential vulnerability in the system shutdown SMI callback function in some ThinkPad models may allow an attacker with local access and elevated privileges…
CVE-2021-3453 - CVSS 6.8 (medium), 2021-07-16: Some Lenovo Notebook, ThinkPad, and Lenovo Desktop systems have BIOS modules unprotected by Intel Boot Guard that could allow an attacker with physical access…
CVE-2020-8352 - CVSS 2.4 (low), 2020-11-11: In some Lenovo Desktop models, the Configuration Change Detection BIOS setting failed to detect SATA configuration changes.
CVE-2020-8354 - CVSS 6.7 (medium), 2020-11-11: A potential vulnerability in the SMI callback function used in the VariableServiceSmm driver in some Lenovo Notebook models may allow arbitrary code execution.
CVE-2020-8333 - CVSS 7.8 (high), 2020-09-24: A potential vulnerability in the SMI callback function used in the EEPROM driver in some Lenovo Desktops and ThinkStation models may allow arbitrary code…
CVE-2020-8321 - CVSS 6.7 (medium), 2020-06-09: A potential vulnerability in the SMI callback function used in the System Lock Preinstallation driver in some Lenovo Notebook and ThinkStation models may…
CVE-2020-8334 - CVSS 6.8 (medium), 2020-06-09: The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad T495s, X395, T495, A485, A285, A475, A275 which may allow for unauthorized access.
CVE-2020-8320 - CVSS 6.8 (medium), 2020-06-09: An internal shell was included in BIOS image in some ThinkPad models that could allow escalation of privilege.
CVE-2020-8323 - CVSS 6.7 (medium), 2020-06-09: A potential vulnerability in the SMI callback function used in the Legacy SD driver in some Lenovo ThinkPad, ThinkStation, and Lenovo Notebook models may…
CVE-2020-8322 - CVSS 6.7 (medium), 2020-06-09: A potential vulnerability in the SMI callback function used in the Legacy USB driver in some Lenovo Notebook and ThinkStation models may allow arbitrary code…
CVE-2020-8336 - CVSS 6.8 (medium), 2020-06-09: Lenovo implemented Intel CSME Anti-rollback ARB protections on some ThinkPad models to prevent roll back of CSME Firmware in flash.
CVE-2019-6190 - CVSS 5.5 (medium), 2020-02-14: Lenovo was notified of a potential denial of service vulnerability, affecting various versions of BIOS for Lenovo Desktop, Desktop - All in One, and…
CVE-2019-6171 - CVSS 6.8 (medium), 2019-08-19: A vulnerability was reported in various BIOS versions of older ThinkPad systems that could allow a user with administrative privileges or physical access the…
CVE-2019-6156 - CVSS 3.3 (low), 2019-04-10: In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient protection, an additional layer of…
CVE-2017-3754 - CVSS 6.7 (medium), 2017-07-17: Some Lenovo brand notebook systems do not have write protections properly configured in the system BIOS. This could enable an attacker with physical or…
CVE-2016-8224 - CVSS 4.4 (medium), 2016-11-29: A vulnerability has been identified in some Lenovo Notebook and ThinkServer systems where an attacker with administrative privileges on a system could install…
CVE-2016-5247 - CVSS 7.8 (high), 2016-09-22: The BIOS for Lenovo ThinkCentre E93, M6500t/s, M6600, M6600q, M6600t/s, M73p, M800, M83, M8500t/s, M8600t/s, M900, M93, and M93P devices; ThinkServer RQ940,…