CVE-2022-40135 json
An information leak vulnerability in the Smart USB Protection SMI Handler in some Lenovo models may allow an attacker with local access and…
published 2023-01-30 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-43453
- cvss
- 4.4
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 9%
- public exploits
- 0
- none known
Summary
An information leak vulnerability in the Smart USB Protection SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to read SMM memory.
Patch / fix
- lenovo ideacentre_c5-14imb05_firmware o4hkt38a
- lenovo thinkcentre_e96z_firmware m26kt22a
- lenovo ideacentre_3_07iab7_firmware m49kt1da
- lenovo ideacentre_3-07imb05_firmware m2vkt1da
- lenovo ideacentre_5_14iab7_firmware m42kt40a
- lenovo ideacentre_5-14acn6_firmware o5ekt21a
- lenovo ideacentre_5-14imb05_firmware o4hkt38a
- lenovo ideacentre_5-14iob6_firmware m3gkt33a
- lenovo ideacentre_g5-14imb05_firmware o4hkt38a
- lenovo ideacentre_gaming_5_17acn7_firmware o5ekt21a
- lenovo ideacentre_gaming_5_17iab7_firmware m42kt40a
- lenovo ideacentre_gaming_5-14acn6_firmware o5ekt21a
- lenovo ideacentre_gaming_5-14iob6_firmware m3gkt33a
- lenovo legion_c530-19icb_firmware o4bkt20a
- lenovo legion_t5-26iob6_firmware o54kt1da
- lenovo legion_t5-28icb05_firmware o4bkt20a
- lenovo legion_t530-28apr_firmware o4gkt16a
- lenovo legion_t530-28icb_firmware o4bkt20a
- lenovo legion_t7-34imz5_firmware o4lkt1ea
- lenovo thinkcentre_m60e_tiny_firmware m3skt21a
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 19 mo ago
Exploit prediction
0.20% chance of exploitation in the next 30 days, higher than 9% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 4.4 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
| NVD | 3.1 | 4.4 | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N |
Affected products
- Lenovo BIOS
Classification
- Weakness
-
- CWE-125 Out-of-bounds Read
References
-
support.lenovo.com
/us/en/product_security/LEN-94953
vendor-advisory
Sources
- CVE List CVE-2022-40135
- NVD CVE-2022-40135
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.