CVE-2023-34419
Medium
Description
A buffer overflow has been identified in the SetupUtility driver in some Lenovo Notebook products which may allow an attacker with local access and elevated privileges to execute arbitrary code.
SeverityMedium
CVSS6.7
Exploit probability—
ProductLenovo Legion 5 Pro 16iah7h Firmware
PublishedAug 17, 2023
First seenAug 17, 2023
Weakness typeCWE-120CWE-120
How to fix
Update
- lenovo legion_5_pro_16iah7h_firmwarej2cn51ww or later
- lenovo legion_5_pro_16iah7_firmwarej2cn51ww or later
- lenovo legion_5_15iah7h_firmwarej2cn51ww or later
- lenovo legion_5_15iah7_firmwarej2cn51ww or later
- lenovo legion_pro_5_16irx8_firmwarekwcn37ww or later
- lenovo legion_pro_7_16irx8_firmwarekwcn37ww or later
- lenovo legion_pro_7_16irx8h_firmwarekwcn37ww or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lenovo legion_5_pro_16iah7h_firmware | v < j2cn51ww | j2cn51ww |
| lenovo legion_5_pro_16iah7_firmware | v < j2cn51ww | j2cn51ww |
| lenovo legion_5_pro_16arh7_firmware | No range specified | — |
| lenovo legion_5_pro_16arh7h_firmware | No range specified | — |
| lenovo legion_5_15arh7_firmware | No range specified | — |
| lenovo legion_5_15arh7h_firmware | No range specified | — |
| lenovo legion_5_15iah7h_firmware | v < j2cn51ww | j2cn51ww |
| lenovo legion_5_15iah7_firmware | v < j2cn51ww | j2cn51ww |
| lenovo legion_5_pro-16ach6_firmware | No range specified | — |
| lenovo legion_5_pro-16ach6h_firmware | No range specified | — |
| lenovo legion_5_pro-16ith6_firmware | No range specified | — |
| lenovo legion_5_pro-16ith6h_firmware | No range specified | — |
| lenovo legion_5-15ach6_firmware | No range specified | — |
| lenovo legion_5-15ach6a_firmware | No range specified | — |
| lenovo legion_5-15ach6h_firmware | No range specified | — |
| lenovo legion_5-15ith6_firmware | No range specified | — |
| lenovo legion_5-15ith6h_firmware | No range specified | — |
| lenovo legion_5-17ach6_firmware | No range specified | — |
| lenovo legion_5-17ach6h_firmware | No range specified | — |
| lenovo legion_5-17ith6_firmware | No range specified | — |
| lenovo legion_5-17ith6h_firmware | No range specified | — |
| lenovo legion_7-16arha7_firmware | No range specified | — |
| lenovo legion_7-16achg6_firmware | No range specified | — |
| lenovo legion_7-16ithg6_firmware | No range specified | — |
| lenovo legion_pro_5_16irx8_firmware | v < kwcn37ww | kwcn37ww |
| lenovo legion_pro_7_16irx8_firmware | v < kwcn37ww | kwcn37ww |
| lenovo legion_pro_7_16irx8h_firmware | v < kwcn37ww | kwcn37ww |
| lenovo legion_s7_16arha7_firmware | No range specified | — |
| lenovo thinkbook_16p_g3_arh_firmware | No range specified | — |
| lenovo thinkbook_15p_g2_ith_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.