CVE-2023-5078
Medium
Description
A vulnerability was reported in some ThinkPad BIOS that could allow a physical or local attacker with elevated privileges to tamper with BIOS firmware.
SeverityMedium
CVSS6.7
Exploit probability—
ProductLenovo Thinkpad X13 Gen 3 Firmware
PublishedNov 8, 2023
First seenNov 8, 2023
Weakness typeCWE-1419CWE-1419
How to fix
Update
- lenovo thinkpad_s2_yoga_gen_7_firmware1.19 or later
- lenovo thinkpad_l14_gen_3_firmware1.23 or later
- lenovo thinkpad_l14_gen_4_firmware1.1 or later
- lenovo thinkpad_l15_gen_3_firmware1.23 or later
- lenovo thinkpad_l15_gen_4_firmware1.1 or later
- lenovo thinkpad_l13_yoga_gen_3_firmware1.19 or later
- lenovo thinkpad_l13_gen_3_firmware1.19 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| lenovo thinkpad_x13_gen_3_firmware | No range specified | — |
| lenovo thinkpad_s2_yoga_gen_7_firmware | v < 1.19 | 1.19 |
| lenovo thinkpad_s2_yoga_gen_6_firmware | No range specified | — |
| lenovo thinkpad_s2_gen_8_firmware | No range specified | — |
| lenovo thinkpad_p14s_gen_3_firmware | No range specified | — |
| lenovo thinkpad_p16s_gen_1_firmware | No range specified | — |
| lenovo thinkpad_t14_gen_3_firmware | No range specified | — |
| lenovo thinkpad_t14s_gen_3_firmware | No range specified | — |
| lenovo thinkpad_t16_gen_1_firmware | No range specified | — |
| lenovo thinkpad_l14_gen_3_firmware | v < 1.23 | 1.23 |
| lenovo thinkpad_l14_gen_4_firmware | v < 1.1 | 1.1 |
| lenovo thinkpad_l15_gen_3_firmware | v < 1.23 | 1.23 |
| lenovo thinkpad_l15_gen_4_firmware | v < 1.1 | 1.1 |
| lenovo thinkpad_l13_yoga_gen_4_firmware | No range specified | — |
| lenovo thinkpad_l13_yoga_gen_3_firmware | v < 1.19 | 1.19 |
| lenovo thinkpad_l13_yoga_gen_2_firmware | No range specified | — |
| lenovo thinkpad_l13_gen_4_firmware | No range specified | — |
| lenovo thinkpad_l13_gen_3_firmware | v < 1.19 | 1.19 |
| lenovo thinkpad_l13_gen_2_firmware | No range specified | — |
| lenovo thinkpad_s2_yoga_gen_8_firmware | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.