60
CVE-2022-3431
—CVSS 3.1
7.8 high
EPSS
<1%p11
Published
()
Modified
Description
A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deactivated may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
- Vendors
- lenovo
- Products
- ideapad creator 5-16ach6 firmware, ideapad 5 pro-16ihu6 firmware, ideapad 5 pro-16ach6 firmware, yoga slim 7-13itl05 firmware, yoga slim 7-13acn05 firmware, yoga slim 7 pro 16arh7 firmware, yoga slim 7 pro 16ach6 firmware, yoga slim 7 carbon 13itl5 firmware, yoga duet 7-13itl6-lte firmware, yoga duet 7-13itl6 firmware, yoga duet 7-13iml05 firmware, thinkbook plus g3 iap firmware
- Weakness
- CWE-276
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H