CVE Feed

    Dashboard / CVE / CVE-2022-4575

    CVE-2022-4575

    A vulnerability due to improper write protection of UEFI variables was reported in the BIOS of some ThinkPad models could allow an attacker with physical or local access and elevated privileges the ability to bypass Secure Boot.

    Published:Oct 30, 2023
    Last Modified:Nov 21, 2024
    EPS:Oct 30, 2023
    EPSS Score:0.00005
    CVSS Score:6.7

    Affected Products

    Vendor
    Lenovo
    Product
    Thinkpad 25
    Vendor
    Lenovo
    Product
    Thinkpad 25 Firmware
    Vendor
    Lenovo
    Product
    Thinkpad L560
    Vendor
    Lenovo
    Product
    Thinkpad L560 Firmware
    Vendor
    Lenovo
    Product
    Thinkpad P50
    Vendor
    Lenovo
    Product
    Thinkpad P50 Firmware
    Vendor
    Lenovo
    Product
    Thinkpad P50s
    Vendor
    Lenovo
    Product
    Thinkpad P50s Firmware
    Vendor
    Lenovo
    Product
    Thinkpad P70
    Vendor
    Lenovo
    Product
    Thinkpad P70 Firmware
    Vendor
    Lenovo
    Product
    Thinkpad T470
    Vendor
    Lenovo
    Product
    Thinkpad T470 Firmware
    Vendor
    Lenovo
    Product
    Thinkpad T470s
    Vendor
    Lenovo
    Product
    Thinkpad T470s Firmware
    Vendor
    Lenovo
    Product
    Thinkpad T560
    Vendor
    Lenovo
    Product
    Thinkpad T560 Firmware
    Vendor
    Lenovo
    Product
    Thinkpad X1 Carbon 4th Gen
    Vendor
    Lenovo
    Product
    Thinkpad X1 Carbon 4th Gen Firmware
    Vendor
    Lenovo
    Product
    Thinkpad X1 Yoga 1st Gen
    Vendor
    Lenovo
    Product
    Thinkpad X1 Yoga 1st Gen Firmware
    Vendor
    Lenovo
    Product
    Thinkpad X260
    Vendor
    Lenovo
    Product
    Thinkpad X260 Firmware
    Vendor
    Lenovo
    Product
    Thinkpad X270
    Vendor
    Lenovo
    Product
    Thinkpad X270 Firmware
    Vendor
    Lenovo
    Product
    Thinkpad Yoga 260
    Vendor
    Lenovo
    Product
    Thinkpad Yoga 260 Firmware

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-276 Incorrect Default Permissions

    Related CVEs

    CVE-2021-3786 (CVSS 4.4) — A potential vulnerability in the SMI callback function used in CSME configuration of some Lenovo Notebook and …
    CVE-2021-3599 (CVSS 6.7) — A potential vulnerability in the SMI callback function used to access flash device in some ThinkPad models may…
    CVE-2021-3462 (CVSS 5.5) — A privilege escalation vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.67.1…
    CVE-2021-3463 (CVSS 4.2) — A null pointer dereference vulnerability in Lenovo Power Management Driver for Windows 10, prior to version 1.…
    CVE-2019-18618 (CVSS 6) — Incorrect access control in the firmware of Synaptics VFS75xx family fingerprint sensors that include external…
    CVE-2019-18619 (CVSS 7.8) — Incorrect parameter validation in the synaTee component of Synaptics WBF drivers using an SGX enclave (all ver…
    CVE-2019-6192 (CVSS 4.4) — A potential vulnerability has been reported in Lenovo Power Management Driver versions prior to 1.67.17.48 lea…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High