During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI handler was discover…

published 2022-04-22 4 y ago modified 2026-06-17 4 mo ago also EUVD-2022-24450

cvss: 6.7; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 19%
public exploits: 0; none known

During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI handler was discovered in some ThinkPad models could be exploited by an attacker with elevated privileges that could allow for execution of code.

Patch / fix

fixed in 20

lenovo thinkpad_11e_firmware n15et78w
lenovo thinkpad_helix_firmware n17eta8w
lenovo thinkpad_l560_firmware n1het85w
lenovo thinkpad_l570_firmware n1xet65w
lenovo thinkpad_p50s_firmware n1ket46w
lenovo thinkpad_p51s_firmware n1vet50w
lenovo thinkpad_p52s_firmware n27et36w
lenovo thinkpad_s540_firmware gpet80ww
lenovo thinkpad_t550_firmware n11et50w
lenovo thinkpad_t560_firmware n1ket46w
lenovo thinkpad_t570_firmware n1vet50w
lenovo thinkpad_t580_firmware n27et36w
lenovo thinkpad_x1_tablet_gen_1_firmware n1let86w
lenovo thinkpad_x1_tablet_gen_2_firmware n1oet50w
lenovo thinkpad_w540_firmware gnet92ww
lenovo thinkpad_w541_firmware gnet92ww
lenovo thinkpad_w550s_firmware n11et50w
lenovo thinkpad_x1_carbon_3rd_gen_firmware n14et52w
lenovo thinkpad_x1_carbon_4th_gen_firmware n1fet70w
lenovo thinkpad_x1_carbon_5th_gen_kabylake_firmware n1met55w

Exploit prediction

0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.7	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	6.7	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.2	AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected products

Lenovo ThinkPad BIOS

Classification

Weakness

CWE-20 Improper Input Validation
CWE-269 Improper Privilege Management

References

support.lenovo.com /us/en/product_security/LEN-84943
vendor-advisory

Sources

CVE List CVE-2022-1107
NVD CVE-2022-1107

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary