Latest Lenovo Vulnerabilities

● CVE-2023-6450
An incorrect permissions vulnerability was reported in the Lenovo App Store app that could allow an attacker to use system resources, resulting in a denial of service.
Lenovo App Store<12.4.20
● CVE-2023-6044
A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker with physical access to impersonate Lenovo Vantage Service and execute arbitrary code with elevate...
Lenovo Vantage<4.0.49.0
● CVE-2023-6043
A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker to bypass integrity checks and execute arbitrary code with elevated privileges.
Lenovo Vantage<4.0.49.0
● CVE-2023-5081
An information disclosure vulnerability was reported in the Lenovo Tab M8 HD that could allow a local application to gather a non-resettable device identifier.
Lenovo Tab M8 Hd Tb8505f Firmware<8505f_usr_s301106_2309140042_v9.56_bmp_row
Lenovo Tab M8 Hd Tb8505f
Lenovo Tab M8 Hd Tb8505fs Firmware<8505fs_usr_s301107_2309140028_v9.56_bmp_row
Lenovo Tab M8 Hd Tb8505fs
Lenovo Tab M8 Hd Tb8505x Firmware<8505x_usr_s301129_2309141226_v9.56_bmp_row
Lenovo Tab M8 Hd Tb8505x
and 2 more
● CVE-2023-5080
A privilege escalation vulnerability was reported in some Lenovo tablet products that could allow local applications access to device identifiers and system commands.
Lenovo Tab M8 Hd Tb8505f Firmware<8505f_usr_s301106_2309140042_v9.56_bmp_row
Lenovo Tab M8 Hd Tb8505f
Lenovo Tab M8 Hd Tb8505fs Firmware<8505fs_usr_s301107_2309140028_v9.56_bmp_row
Lenovo Tab M8 Hd Tb8505fs
Lenovo Tab M8 Hd Tb8505x Firmware<8505x_usr_s301129_2309141226_v9.56_bmp_row
Lenovo Tab M8 Hd Tb8505x
and 6 more
● CVE-2023-6540
A vulnerability was reported in the Lenovo Browser Mobile and Lenovo Browser HD Apps for Android that could allow an attacker to craft a payload that could result in the disclosure of sensitive inform...
Lenovo Browser Hd<2.1.4.1
Lenovo Browser Mobile<9.1.3.1
● CVE-2023-6338
Uncontrolled search path vulnerabilities were reported in the Lenovo Universal Device Client (UDC) that could allow an attacker with local access to execute code with elevated privileges.
Lenovo Universal Device Client<23.10
● CVE-2023-43576
A buffer overflow was reported in the WMISwSmi module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
Lenovo Ideacentre C5-14imb05 Firmware<o4hkt3ca
Lenovo Ideacentre C5-14imb05
Lenovo Ideacentre 3-07ada05 Firmware<o4fkt39a
Lenovo Ideacentre 3-07ada05
Lenovo Ideacentre 3-07imb05 Firmware<m2vkt21a
Lenovo Ideacentre 3-07imb05
and 218 more
● CVE-2023-43575
A buffer overflow was reported in the UltraFunctionTable module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
Lenovo Ideacentre C5-14imb05 Firmware<o4hkt3ca
Lenovo Ideacentre C5-14imb05
Lenovo Ideacentre 3-07ada05 Firmware<o4fkt39a
Lenovo Ideacentre 3-07ada05
Lenovo Ideacentre 3-07imb05 Firmware<m2vkt21a
Lenovo Ideacentre 3-07imb05
and 218 more
● CVE-2023-43574
A buffer over-read was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to disclose sensitive informatio...
Lenovo Ideacentre C5-14imb05 Firmware<o4hkt3ca
Lenovo Ideacentre C5-14imb05
Lenovo Ideacentre 3-07ada05 Firmware<o4fkt39a
Lenovo Ideacentre 3-07ada05
Lenovo Ideacentre 3-07imb05 Firmware<m2vkt21a
Lenovo Ideacentre 3-07imb05
and 218 more
● CVE-2023-43573
A buffer overflow was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
Lenovo Ideacentre C5-14imb05 Firmware<o4hkt3ca
Lenovo Ideacentre C5-14imb05
Lenovo Ideacentre 3-07ada05 Firmware<o4fkt39a
Lenovo Ideacentre 3-07ada05
Lenovo Ideacentre 3-07imb05 Firmware<m2vkt21a
Lenovo Ideacentre 3-07imb05
and 218 more
● CVE-2023-43572
A buffer over-read was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to disclose sensitive information.
Lenovo Ideacentre C5-14imb05 Firmware<o4hkt3ca
Lenovo Ideacentre C5-14imb05
Lenovo Ideacentre 3-07ada05 Firmware<o4fkt39a
Lenovo Ideacentre 3-07ada05
Lenovo Ideacentre 3-07imb05 Firmware<m2vkt21a
Lenovo Ideacentre 3-07imb05
and 218 more
● CVE-2023-45078
A memory leakage vulnerability was reported in the DustFilterAlertSmm SMM driver that may allow a local attacker with elevated privileges to write to NVRAM variables.
Lenovo Ideacentre C5-14imb05 Firmware<o4hkt3ca
Lenovo Ideacentre C5-14imb05
Lenovo Ideacentre 3-07ada05 Firmware<o4fkt39a
Lenovo Ideacentre 3-07ada05
Lenovo Ideacentre 3-07imb05 Firmware<m2vkt21a
Lenovo Ideacentre 3-07imb05
and 117 more
● CVE-2023-45077
Lenovo Ideacentre C5-14imb05 Firmware<o4hkt3ca
Lenovo Ideacentre C5-14imb05
Lenovo Ideacentre 3-07ada05 Firmware<o4fkt39a
Lenovo Ideacentre 3-07ada05
Lenovo Ideacentre 3-07imb05 Firmware<m2vkt21a
Lenovo Ideacentre 3-07imb05
and 117 more
● CVE-2023-45075
Lenovo Ideacentre C5-14imb05 Firmware<o4hkt3ca
Lenovo Ideacentre C5-14imb05
Lenovo Ideacentre 3-07ada05 Firmware<o4fkt39a
Lenovo Ideacentre 3-07ada05
Lenovo Ideacentre 3-07imb05 Firmware<m2vkt21a
Lenovo Ideacentre 3-07imb05
and 117 more
● CVE-2023-43581
A buffer overflow was reported in the Update_WMI module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
Lenovo Ideacentre C5-14imb05 Firmware<o4hkt3ca
Lenovo Ideacentre C5-14imb05
Lenovo Ideacentre 3-07ada05 Firmware<o4fkt39a
Lenovo Ideacentre 3-07ada05
Lenovo Ideacentre 3-07imb05 Firmware<m2vkt21a
Lenovo Ideacentre 3-07imb05
and 218 more
● CVE-2023-43580
A buffer overflow was reported in the SmuV11DxeVMR module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
Lenovo Ideacentre C5-14imb05 Firmware<o4hkt3ca
Lenovo Ideacentre C5-14imb05
Lenovo Ideacentre 3-07ada05 Firmware<o4fkt39a
Lenovo Ideacentre 3-07ada05
Lenovo Ideacentre 3-07imb05 Firmware<m2vkt21a
Lenovo Ideacentre 3-07imb05
and 218 more
● CVE-2023-43579
A buffer overflow was reported in the SmuV11Dxe driver in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
Lenovo Ideacentre C5-14imb05 Firmware<o4hkt3ca
Lenovo Ideacentre C5-14imb05
Lenovo Ideacentre 3-07ada05 Firmware<o4fkt39a
Lenovo Ideacentre 3-07ada05
Lenovo Ideacentre 3-07imb05 Firmware<m2vkt21a
Lenovo Ideacentre 3-07imb05
and 218 more
● CVE-2023-43578
A buffer overflow was reported in the SmiFlash module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
Lenovo Ideacentre C5-14imb05 Firmware<o4hkt3ca
Lenovo Ideacentre C5-14imb05
Lenovo Ideacentre 3-07ada05 Firmware<o4fkt39a
Lenovo Ideacentre 3-07ada05
Lenovo Ideacentre 3-07imb05 Firmware<m2vkt21a
Lenovo Ideacentre 3-07imb05
and 218 more
● CVE-2023-43571
A buffer overflow was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
Lenovo Ideacentre C5-14imb05 Firmware<o4hkt3ca
Lenovo Ideacentre C5-14imb05
Lenovo Ideacentre 3-07ada05 Firmware<o4fkt39a
Lenovo Ideacentre 3-07ada05
Lenovo Ideacentre 3-07imb05 Firmware<m2vkt21a
Lenovo Ideacentre 3-07imb05
and 218 more
● CVE-2023-43570
Lenovo Ideacentre C5-14imb05 Firmware<o4hkt3ca
Lenovo Ideacentre C5-14imb05
Lenovo Ideacentre 3-07ada05 Firmware<o4fkt39a
Lenovo Ideacentre 3-07ada05
Lenovo Ideacentre 3-07imb05 Firmware<m2vkt21a
Lenovo Ideacentre 3-07imb05
and 218 more
● CVE-2023-43569
A buffer overflow was reported in the OemSmi module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code. 
Lenovo Ideacentre C5-14imb05 Firmware<o4hkt3ca
Lenovo Ideacentre C5-14imb05
Lenovo Ideacentre 3-07ada05 Firmware<o4fkt39a
Lenovo Ideacentre 3-07ada05
Lenovo Ideacentre 3-07imb05 Firmware<m2vkt21a
Lenovo Ideacentre 3-07imb05
and 218 more
● CVE-2023-43568
A buffer over-read was reported in the LemSecureBootForceKey module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to disclose sensitive information.
Lenovo Ideacentre C5-14imb05 Firmware<o4hkt3ca
Lenovo Ideacentre C5-14imb05
Lenovo Ideacentre 3-07ada05 Firmware<o4fkt39a
Lenovo Ideacentre 3-07ada05
Lenovo Ideacentre 3-07imb05 Firmware<m2vkt21a
Lenovo Ideacentre 3-07imb05
and 218 more
● CVE-2023-43567
A buffer overflow was reported in the LemSecureBootForceKey module in some Lenovo Desktop products that may allow a local attacker with elevated privileges to execute arbitrary code.
Lenovo Ideacentre C5-14imb05 Firmware<o4hkt3ca
Lenovo Ideacentre C5-14imb05
Lenovo Ideacentre 3-07ada05 Firmware<o4fkt39a
Lenovo Ideacentre 3-07ada05
Lenovo Ideacentre 3-07imb05 Firmware<m2vkt21a
Lenovo Ideacentre 3-07imb05
and 218 more
● CVE-2023-5079
Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could result in information disclosure.
Lenovo LeCloud<7.0.25.99
● CVE-2023-5078
A vulnerability was reported in some ThinkPad BIOS that could allow a physical or local attacker with elevated privileges to tamper with BIOS firmware.
Lenovo Thinkpad X13 Gen 3 Firmware
Lenovo Thinkpad X13 Gen 3
Lenovo Thinkpad S2 Yoga Gen 7 Firmware<1.19
Lenovo Thinkpad S2 Yoga Gen 7
Lenovo Thinkpad S2 Yoga Gen 6 Firmware
Lenovo Thinkpad S2 Yoga Gen 6
and 34 more
● CVE-2023-5075
A buffer overflow was reported in the FmpSipoCapsuleDriver driver in the IdeaPad Duet 3-10IGL5 that may allow a local attacker with elevated privileges to execute arbitrary code.
Lenovo Ideapad Duet 3 10igl5 Firmware<eqcn39ww
Lenovo Ideapad Duet 3 10igl5
● CVE-2023-4706
A privilege escalation vulnerability was reported in Lenovo preloaded devices deployed using Microsoft AutoPilot under a standard user account due to incorrect default privileges.
Lenovo Preload Directory
● CVE-2023-4632
An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local access to execute code with elevated privileges.
Lenovo System Update<5.08.02.25
● CVE-2022-4575
A vulnerability due to improper write protection of UEFI variables was reported in the BIOS of some ThinkPad models could allow an attacker with physical or local access and elevated privileges the a...
Lenovo Thinkpad 25 Firmware<1.73
Lenovo Thinkpad 25
Lenovo Thinkpad L560 Firmware<1.62
Lenovo Thinkpad L560
Lenovo Thinkpad P50 Firmware<1.71
Lenovo Thinkpad P50
and 20 more
● CVE-2022-48189
An SMM driver input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code.
Lenovo Thinkpad E14 Firmware<1.23
Lenovo Thinkpad E14
Lenovo Thinkpad E14 Gen 2 Firmware<1.55
Lenovo Thinkpad E14 Gen 2
Lenovo Thinkpad E14 Gen 4 Firmware<1.18
Lenovo Thinkpad E14 Gen 4
and 174 more
● CVE-2022-4574
An SMI handler input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code.  
Lenovo Thinkpad X13 Yoga Gen 2 Firmware<1.40
Lenovo Thinkpad X13 Yoga Gen 2
Lenovo Thinkpad X13 Yoga Gen 1 Firmware<1.45
Lenovo Thinkpad X13 Yoga Gen 1
Lenovo Thinkpad X13 Gen 3 Firmware<1.33
Lenovo Thinkpad X13 Gen 3
and 102 more
● CVE-2022-4573
An SMI handler input validation vulnerability in the ThinkPad X1 Fold Gen 1 could allow an attacker with local access and elevated privileges to execute arbitrary code.
Lenovo Thinkpad X1 Fold Gen 1 Firmware
Lenovo Thinkpad X1 Fold Gen 1
● CVE-2022-3702
A denial of service vulnerability was reported in Lenovo Vantage HardwareScan Plugin version 1.3.0.5 and earlier that could allow a local attacker to delete contents of an arbitrary directory under c...
Lenovo System Update Plugin<2.0.0.213
Lenovo Hardware Scan Plugin<1.3.1.2
Lenovo Hardware Scan Addin<2.4.1.1
● CVE-2022-3700
A Time of Check Time of Use (TOCTOU) vulnerability was reported in the Lenovo Vantage SystemUpdate Plugin version 2.0.0.212 and earlier that could allow a local attacker to delete arbitrary files.
Lenovo System Update Plugin<2.0.0.213
Lenovo Hardware Scan Plugin<1.3.1.2
Lenovo Hardware Scan Addin<2.4.1.1
● CVE-2022-3611
An information disclosure vulnerability has been identified in the Lenovo App Store which may allow some applications to gain unauthorized access to sensitive user data used by other unrelated applica...
Lenovo App Store App<11.8.0
● CVE-2022-3429
A denial-of-service vulnerability was found in the firmware used in Lenovo printers, where users send illegal or malformed strings to an open port, triggering a denial of service that causes a display...
Lenovo Gm265dn Firmware
Lenovo Gm265dn
Lenovo Gm266dns Firmware<02.06.00.04.00
Lenovo Gm266dns
Lenovo G263dns Firmware<02.06.00.04.00
Lenovo G263dns
● CVE-2022-34887
Standard users can directly operate and set printer configuration information , such as IP, in some Lenovo Printers without having to authenticate with the administrator password.
Lenovo Gm265dn Firmware
Lenovo Gm265dn
Lenovo Gm266dns Firmware<02.06.00.04.00
Lenovo Gm266dns
Lenovo G263dns Firmware<02.06.00.04.00
Lenovo G263dns
● CVE-2022-34886
Lenovo Gm265dn Firmware
Lenovo Gm265dn
Lenovo Gm266dns Firmware<02.06.00.04.00
Lenovo Gm266dns
Lenovo G263dns Firmware<02.06.00.04.00
Lenovo G263dns
● CVE-2023-4607
An authenticated XCC user can change permissions for any user through a crafted API command.
Lenovo Thinkagile Hx5530 Firmware
Lenovo Thinkagile Hx5530
Lenovo Thinkagile Hx7530 Firmware
Lenovo Thinkagile Hx7530
Lenovo Thinkagile Vx3331 Firmware
Lenovo Thinkagile Vx3331
and 225 more
● CVE-2023-4608
An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command.  This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1...
Lenovo Thinkagile Hx5530 Firmware
Lenovo Thinkagile Hx5530
Lenovo Thinkagile Hx7530 Firmware
Lenovo Thinkagile Hx7530
Lenovo Thinkagile Vx3331 Firmware
Lenovo Thinkagile Vx3331
and 98 more
● CVE-2023-4606
An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command.   This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers...
Lenovo Thinkagile Hx5530 Firmware
Lenovo Thinkagile Hx5530
Lenovo Thinkagile Hx7530 Firmware
Lenovo Thinkagile Hx7530
Lenovo Thinkagile Vx3331 Firmware
Lenovo Thinkagile Vx3331
and 98 more
● CVE-2023-3112
A vulnerability was reported in Elliptic Labs Virtual Lock Sensor for ThinkPad T14 Gen 3 that could allow an attacker with local access to execute code with elevated privileges.
Ellipticlabs Ai Virtual Presence Sensor<3.1.50719.1
Ellipticlabs Virtual Lock Sensor<3.1.50719.1
Lenovo Thinkpad T14 Gen 3
● CVE-2022-3699
A privilege escalation vulnerability was reported in the Lenovo HardwareScanPlugin prior to version 1.3.1.2 and Lenovo Diagnostics prior to version 4.45 that could allow a local user to execute c...
Lenovo Diagnostics<4.45.0
Lenovo Hardwarescan Addin<2.4.1.1
Lenovo Hardwarescan Plugin<1.3.1.2
● CVE-2022-3698
A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to 1.3.1.2 and  Lenovo Diagnostics versions prior to 4.45 that could allow a local user with admi...
Lenovo Diagnostics<4.45.0
Lenovo Hardwarescan Plugin<1.3.1.2
● CVE-2022-0353
A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to 1.3.1.2 and  Lenovo Diagnostics versions prior to 4.45 that could allow a local user with admi...
Lenovo Diagnostics<4.45.0
Lenovo Hardwarescan Addin<2.4.1.1
Lenovo Hardwarescan Plugin<1.3.1.2
● CVE-2022-48183
A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstances which could allow unauthorized access...
Lenovo Thinkpad T14s Gen 3 Firmware<1.30
Lenovo Thinkpad T14s Gen 3
Microsoft Windows
Lenovo Thinkpad X13 Gen 3 Firmware<1.30
Lenovo Thinkpad X13 Gen 3
Lenovo Thinkpad T14s Gen 3 Firmware<1.35
and 2 more
● CVE-2022-48182
A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstances which could allow unauthorized access...
Lenovo Thinkpad T14s Gen 3 Firmware<1.30
Lenovo Thinkpad T14s Gen 3
Microsoft Windows
Lenovo Thinkpad X13 Gen 3 Firmware<1.30
Lenovo Thinkpad X13 Gen 3
Lenovo Thinkpad T14s Gen 3 Firmware<1.35
and 2 more
● CVE-2022-3728
A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstances which could allow unauthorized access...
Lenovo Thinkpad T14s Gen 3 Firmware<1.30
Lenovo Thinkpad T14s Gen 3
Lenovo Thinkpad X13 Gen 3 Firmware<1.30
Lenovo Thinkpad X13 Gen 3
● CVE-2022-3431
A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to m...
Lenovo Ideapad Creator 5-16ach6 Firmware<gscn34ww
Lenovo Ideapad Creator 5-16ach6
Lenovo Ideapad 5 Pro-16ihu6 Firmware<grcn22ww
Lenovo Ideapad 5 Pro-16ihu6
Lenovo Ideapad 5 Pro-16ach6 Firmware<gscn34ww
Lenovo Ideapad 5 Pro-16ach6
and 44 more

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203