CVE Feed

    Dashboard / CVE / CVE-2022-3431

    CVE-2022-3431

    A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.

    Published:Oct 9, 2023
    Last Modified:Nov 21, 2024
    EPS:Oct 9, 2023
    EPSS Score:0.00035
    CVSS Score:6.7

    Affected Products

    Vendor
    Lenovo
    Product
    D330-10igl
    Vendor
    Lenovo
    Product
    D330-10igl Firmware
    Vendor
    Lenovo
    Product
    Ideapad 5 Pro-16ach6
    Vendor
    Lenovo
    Product
    Ideapad 5 Pro-16ach6 Firmware
    Vendor
    Lenovo
    Product
    Ideapad 5 Pro-16ihu6
    Vendor
    Lenovo
    Product
    Ideapad 5 Pro-16ihu6 Firmware
    Vendor
    Lenovo
    Product
    Ideapad 5 Pro 16arh7
    Vendor
    Lenovo
    Product
    Ideapad 5 Pro 16arh7 Firmware
    Vendor
    Lenovo
    Product
    Ideapad Creator 5-16ach6
    Vendor
    Lenovo
    Product
    Ideapad Creator 5-16ach6 Firmware
    Vendor
    Lenovo
    Product
    Ideapad Duet 3 10igl5
    Vendor
    Lenovo
    Product
    Ideapad Duet 3 10igl5 Firmware
    Vendor
    Lenovo
    Product
    Ideapad Slim 7 Pro 16ach6
    Vendor
    Lenovo
    Product
    Ideapad Slim 7 Pro 16ach6 Firmware
    Vendor
    Lenovo
    Product
    Notebook
    Vendor
    Lenovo
    Product
    S540-15iml
    Vendor
    Lenovo
    Product
    S540-15iml Firmware
    Vendor
    Lenovo
    Product
    Slim 7 16arh7
    Vendor
    Lenovo
    Product
    Slim 7 16arh7 Firmware
    Vendor
    Lenovo
    Product
    Thinkbook 13x Itg
    Vendor
    Lenovo
    Product
    Thinkbook 13x Itg Firmware
    Vendor
    Lenovo
    Product
    Thinkbook 14 G4\+ Ara
    Vendor
    Lenovo
    Product
    Thinkbook 14 G4\+ Ara Firmware
    Vendor
    Lenovo
    Product
    Thinkbook 14 G4\+ Iap
    Vendor
    Lenovo
    Product
    Thinkbook 14 G4\+ Iap Firmware
    Vendor
    Lenovo
    Product
    Thinkbook 16 G4\+ Ara
    Vendor
    Lenovo
    Product
    Thinkbook 16 G4\+ Ara Firmware
    Vendor
    Lenovo
    Product
    Thinkbook 16 G4\+ Iap
    Vendor
    Lenovo
    Product
    Thinkbook 16 G4\+ Iap Firmware
    Vendor
    Lenovo
    Product
    Thinkbook 16p Nx Arh
    Vendor
    Lenovo
    Product
    Thinkbook 16p Nx Arh Firmware
    Vendor
    Lenovo
    Product
    Thinkbook Plus G2 Itg
    Vendor
    Lenovo
    Product
    Thinkbook Plus G2 Itg Firmware
    Vendor
    Lenovo
    Product
    Thinkbook Plus G3 Iap
    Vendor
    Lenovo
    Product
    Thinkbook Plus G3 Iap Firmware
    Vendor
    Lenovo
    Product
    Yoga Duet 7-13iml05
    Vendor
    Lenovo
    Product
    Yoga Duet 7-13iml05 Firmware
    Vendor
    Lenovo
    Product
    Yoga Duet 7-13itl6
    Vendor
    Lenovo
    Product
    Yoga Duet 7-13itl6-lte
    Vendor
    Lenovo
    Product
    Yoga Duet 7-13itl6-lte Firmware
    Vendor
    Lenovo
    Product
    Yoga Duet 7-13itl6 Firmware
    Vendor
    Lenovo
    Product
    Yoga Slim 7-13acn05
    Vendor
    Lenovo
    Product
    Yoga Slim 7-13acn05 Firmware
    Vendor
    Lenovo
    Product
    Yoga Slim 7-13itl05
    Vendor
    Lenovo
    Product
    Yoga Slim 7-13itl05 Firmware
    Vendor
    Lenovo
    Product
    Yoga Slim 7 Carbon 13itl5
    Vendor
    Lenovo
    Product
    Yoga Slim 7 Carbon 13itl5 Firmware
    Vendor
    Lenovo
    Product
    Yoga Slim 7 Pro 16ach6
    Vendor
    Lenovo
    Product
    Yoga Slim 7 Pro 16ach6 Firmware
    Vendor
    Lenovo
    Product
    Yoga Slim 7 Pro 16arh7
    Vendor
    Lenovo
    Product
    Yoga Slim 7 Pro 16arh7 Firmware

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-276 Incorrect Default Permissions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High