CVE-2022-4575

EUVD-2022-51908
A vulnerability due to improper write protection of UEFI variables was reported in the BIOS of some ThinkPad models could allow an attacker with physical or local access and elevated privileges the ability to bypass Secure Boot.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.7 MEDIUM
LOCAL
LOW
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
lenovoCNA
6.7 MEDIUM
LOCAL
LOW
HIGH
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
lenovothinkpad_25_firmware
𝑥
< 1.73
lenovothinkpad_l560_firmware
𝑥
< 1.62
lenovothinkpad_p50_firmware
𝑥
< 1.71
lenovothinkpad_p50s_firmware
𝑥
< 1.45
lenovothinkpad_p70_firmware
𝑥
< 2.45
lenovothinkpad_t470_firmware
𝑥
< 1.73
lenovothinkpad_t470s_firmware
𝑥
< 1.49
lenovothinkpad_t560_firmware
𝑥
< 1.45
lenovothinkpad_x1_carbon_4th_gen_firmware
𝑥
< 1.56
lenovothinkpad_x1_yoga_1st_gen_firmware
𝑥
< 1.56
lenovothinkpad_x260_firmware
𝑥
< 1.50
lenovothinkpad_x270_firmware
𝑥
< 1.47
lenovothinkpad_yoga_260_firmware
𝑥
< 1.88
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://support.lenovo.com/us/en/product_security/LEN-106014
https://support.lenovo.com/us/en/product_security/LEN-106014