VulnerabilityModified
CVE-2022-3430
A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
MEDIUM 6.7EPSS 0.26%
Does this matter?
Lower severity and a low EPSS score (0.26%). Track it; it rarely justifies an emergency change on its own.
Description
A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
- CVSS 3.1
- 6.7 MEDIUMCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.26% probability · 17th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-276
- Affected
- lenovo/d330-10igl firmware · lenovo/ideapad 5 pro 16iah7 firmware · lenovo/ideapad 5 pro 16arh7 firmware · lenovo/ideapad duet 3 10igl5 firmware · lenovo/slim 7 16arh7 firmware · lenovo/thinkbook 15p imp firmware · lenovo/slim 7-14are05 firmware · lenovo/ideapad slim 7-14iil05 firmware · lenovo/ideapad slim 7-14itl05 firmware · lenovo/ideapad slim 7-15iil05 firmware · lenovo/slim 7-15imh05 firmware · lenovo/slim 7-15itl05 firmware · lenovo/thinkbook 13x itg firmware · lenovo/thinkbook 14 g2 are firmware · lenovo/thinkbook 14 g2 itl firmware · lenovo/thinkbook 14 g3 acl firmware · lenovo/thinkbook 14 g3 itl firmware · lenovo/thinkbook 14 g4\+ ara firmware · lenovo/thinkbook 14 g4\+ iap firmware · lenovo/thinkbook 14p g3 arh firmware · +24 more
- Source
- psirt@lenovo.com
References
- https://support.lenovo.com/us/en/product_security/LEN-94952Vendor Advisory
- https://support.lenovo.com/us/en/product_security/LEN-94952Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.