6.7

CVE-2022-4575

A vulnerability due to improper write protection of UEFI variables was reported in the BIOS of some ThinkPad models could allow an attacker with physical or local access and elevated privileges the ability to bypass Secure Boot.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Lenovo ≫ Thinkpad 25 Firmware Version < 1.73
   Lenovo ≫ Thinkpad 25 Version -
Lenovo ≫ Thinkpad L560 Firmware Version < 1.62
   Lenovo ≫ Thinkpad L560 Version -
Lenovo ≫ Thinkpad P50 Firmware Version < 1.71
   Lenovo ≫ Thinkpad P50 Version -
Lenovo ≫ Thinkpad P50s Firmware Version < 1.45
   Lenovo ≫ Thinkpad P50s Version -
Lenovo ≫ Thinkpad P70 Firmware Version < 2.45
   Lenovo ≫ Thinkpad P70 Version -
Lenovo ≫ Thinkpad T470 Firmware Version < 1.73
   Lenovo ≫ Thinkpad T470 Version -
Lenovo ≫ Thinkpad T470s Firmware Version < 1.49
   Lenovo ≫ Thinkpad T470s Version -
Lenovo ≫ Thinkpad T560 Firmware Version < 1.45
   Lenovo ≫ Thinkpad T560 Version -
Lenovo ≫ Thinkpad X260 Firmware Version < 1.50
   Lenovo ≫ Thinkpad X260 Version -
Lenovo ≫ Thinkpad X270 Firmware Version < 1.47
   Lenovo ≫ Thinkpad X270 Version -
Lenovo ≫ Thinkpad Yoga 260 Firmware Version < 1.88
   Lenovo ≫ Thinkpad Yoga 260 Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.18% 0.077
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Lenovo 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-276 Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.

https://support.lenovo.com/us/en/product_security/LEN-106014
Vendor Advisory