CVE-2022-3430 json
A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges t…
published 2023-01-23 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-42806
- cvss
- 6.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 18%
- public exploits
- 0
- none known
Summary
A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot setting by modifying an NVRAM variable.
Patch / fix
- lenovo d330-10igl_firmware g0cn11ww
- lenovo ideapad_5_pro_16iah7_firmware j4cn33ww
- lenovo ideapad_5_pro_16arh7_firmware j5cn27ww
- lenovo ideapad_duet_3_10igl5_firmware eqcn37ww
- lenovo slim_7_16arh7_firmware klcn15ww
- lenovo thinkbook_15p_imp_firmware f6cn25ww
- lenovo slim_7-14are05_firmware dmcn43ww
- lenovo ideapad_slim_7-14iil05_firmware dhcn35ww
- lenovo ideapad_slim_7-14itl05_firmware fbcn29ww
- lenovo ideapad_slim_7-15iil05_firmware dhcn35ww
- lenovo slim_7-15imh05_firmware dncn32ww
- lenovo slim_7-15itl05_firmware fbcn29ww
- lenovo thinkbook_13x_itg_firmware hlcn30ww
- lenovo thinkbook_14_g2_are_firmware facn33ww
- lenovo thinkbook_14_g2_itl_firmware f8cn52ww
- lenovo thinkbook_14_g3_acl_firmware gqcn35ww_hfcn30ww
- lenovo thinkbook_14_g3_itl_firmware hrcn13ww
- lenovo thinkbook_14_g4+_ara_firmware j6cn40ww
- lenovo thinkbook_14_g4+_iap_firmware hycn40ww
- lenovo thinkbook_14p_g3_arh_firmware k4cn31ww
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 19 mo ago
Exploit prediction
0.27% chance of exploitation in the next 30 days, higher than 18% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.7 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 6.7 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected products
- Lenovo BIOS
Classification
- Weakness
-
- CWE-276 Incorrect Default Permissions
References
-
support.lenovo.com
/us/en/product_security/LEN-94952
vendor-advisory
Sources
- CVE List CVE-2022-3430
- NVD CVE-2022-3430
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.