6.7

CVE-2022-4575

A vulnerability due to improper write protection of UEFI variables was reported in the BIOS of some ThinkPad models could allow an attacker with physical or local access and elevated privileges the ability to bypass Secure Boot.

Data is provided by the National Vulnerability Database (NVD)
Lenovo ≫ Thinkpad 25 Firmware Version < 1.73
   Lenovo ≫ Thinkpad 25 Version-
Lenovo ≫ Thinkpad L560 Firmware Version < 1.62
   Lenovo ≫ Thinkpad L560 Version-
Lenovo ≫ Thinkpad P50 Firmware Version < 1.71
   Lenovo ≫ Thinkpad P50 Version-
Lenovo ≫ Thinkpad P50s Firmware Version < 1.45
   Lenovo ≫ Thinkpad P50s Version-
Lenovo ≫ Thinkpad P70 Firmware Version < 2.45
   Lenovo ≫ Thinkpad P70 Version-
Lenovo ≫ Thinkpad T470 Firmware Version < 1.73
   Lenovo ≫ Thinkpad T470 Version-
Lenovo ≫ Thinkpad T470s Firmware Version < 1.49
   Lenovo ≫ Thinkpad T470s Version-
Lenovo ≫ Thinkpad T560 Firmware Version < 1.45
   Lenovo ≫ Thinkpad T560 Version-
Lenovo ≫ Thinkpad X260 Firmware Version < 1.50
   Lenovo ≫ Thinkpad X260 Version-
Lenovo ≫ Thinkpad X270 Firmware Version < 1.47
   Lenovo ≫ Thinkpad X270 Version-
Lenovo ≫ Thinkpad Yoga 260 Firmware Version < 1.88
   Lenovo ≫ Thinkpad Yoga 260 Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.01% 0.001
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
psirt@lenovo.com 6.7 0.8 5.9
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-276 Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.