CVE-2022-3431
Medium
Description
A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
SeverityMedium
CVSS6.7
Exploit probability—
ProductLenovo Ideapad Creator 5-16ach6 Firmware
PublishedOct 9, 2023
First seenOct 9, 2023
Weakness typeCWE-276CWE-276
How to fix
Update
- lenovo ideapad_creator_5-16ach6_firmwaregscn34ww or later
- lenovo ideapad_5_pro-16ihu6_firmwaregrcn22ww or later
- lenovo ideapad_5_pro-16ach6_firmwaregscn34ww or later
- lenovo yoga_slim_7-13itl05_firmwaref7cn39ww or later
- lenovo yoga_slim_7-13acn05_firmwareghcn28ww or later
- lenovo yoga_slim_7_pro_16arh7_firmwareklcn15ww or later
- lenovo yoga_slim_7_pro_16ach6_firmwarehucn16ww or later
- lenovo yoga_slim_7_carbon_13itl5_firmwaref7cn39ww or later
- lenovo yoga_duet_7-13itl6-lte_firmwaregpcn24ww or later
- lenovo yoga_duet_7-13itl6_firmwaregpcn24ww or later
- lenovo yoga_duet_7-13iml05_firmwareercn30ww or later
- lenovo thinkbook_plus_g3_iap_firmwarek6cn29ww or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lenovo ideapad_creator_5-16ach6_firmware | v < gscn34ww | gscn34ww |
| lenovo ideapad_5_pro-16ihu6_firmware | v < grcn22ww | grcn22ww |
| lenovo ideapad_5_pro-16ach6_firmware | v < gscn34ww | gscn34ww |
| lenovo yoga_slim_7-13itl05_firmware | v < f7cn39ww | f7cn39ww |
| lenovo yoga_slim_7-13acn05_firmware | v < ghcn28ww | ghcn28ww |
| lenovo yoga_slim_7_pro_16arh7_firmware | v < klcn15ww | klcn15ww |
| lenovo yoga_slim_7_pro_16ach6_firmware | v < hucn16ww | hucn16ww |
| lenovo yoga_slim_7_carbon_13itl5_firmware | v < f7cn39ww | f7cn39ww |
| lenovo yoga_duet_7-13itl6-lte_firmware | v < gpcn24ww | gpcn24ww |
| lenovo yoga_duet_7-13itl6_firmware | v < gpcn24ww | gpcn24ww |
| lenovo yoga_duet_7-13iml05_firmware | v < ercn30ww | ercn30ww |
| lenovo thinkbook_plus_g3_iap_firmware | v < k6cn29ww | k6cn29ww |
| lenovo thinkbook_plus_g2_itg_firmware | v < gycn31ww | gycn31ww |
| lenovo thinkbook_16p_nx_arh_firmware | v < kjcn27ww | kjcn27ww |
| lenovo thinkbook_16_g4\+_iap_firmware | v < hycn40ww | hycn40ww |
| lenovo thinkbook_16_g4\+_ara_firmware | v < j6cn40ww | j6cn40ww |
| lenovo thinkbook_14_g4\+_iap_firmware | v < hycn40ww | hycn40ww |
| lenovo thinkbook_14_g4\+_ara_firmware | v < j6cn40ww | j6cn40ww |
| lenovo thinkbook_13x_itg_firmware | v < hlcn30ww | hlcn30ww |
| lenovo ideapad_slim_7_pro_16ach6_firmware | v < hucn16ww | hucn16ww |
| lenovo s540-15iml_firmware | v < cncn22ww | cncn22ww |
| lenovo slim_7_16arh7_firmware | v < klcn15ww | klcn15ww |
| lenovo ideapad_duet_3_10igl5_firmware | v < eqcn37ww | eqcn37ww |
| lenovo ideapad_5_pro_16arh7_firmware | v < j4cn33ww | j4cn33ww |
| lenovo d330-10igl_firmware | v < g0cn11ww | g0cn11ww |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.